[Mon Nov 10 18:37:31.005742 2025] [rewrite:trace3] [pid 8734:tid 8806] mod_rewrite.c(505): [client 196.251.85.129:49173] 196.251.85.129 - - [paramountestate.com.au/sid#1b9c000][rid#7f74dc002970/initial] [perdir /home/paramount/public_html/] add path info postfix: /home/paramount/public_html/wp-admin -> /home/paramount/public_html/wp-admin/css/, referer: binance.com
[Mon Nov 10 18:37:31.005816 2025] [rewrite:trace3] [pid 8734:tid 8806] mod_rewrite.c(505): [client 196.251.85.129:49173] 196.251.85.129 - - [paramountestate.com.au/sid#1b9c000][rid#7f74dc002970/initial] [perdir /home/paramount/public_html/] strip per-dir prefix: /home/paramount/public_html/wp-admin/css/ -> wp-admin/css/, referer: binance.com
[Mon Nov 10 18:37:31.005827 2025] [rewrite:trace3] [pid 8734:tid 8806] mod_rewrite.c(505): [client 196.251.85.129:49173] 196.251.85.129 - - [paramountestate.com.au/sid#1b9c000][rid#7f74dc002970/initial] [perdir /home/paramount/public_html/] applying pattern '^(.*)' to uri 'wp-admin/css/', referer: binance.com
[Mon Nov 10 18:37:31.005840 2025] [rewrite:trace2] [pid 8734:tid 8806] mod_rewrite.c(505): [client 196.251.85.129:49173] 196.251.85.129 - - [paramountestate.com.au/sid#1b9c000][rid#7f74dc002970/initial] [perdir /home/paramount/public_html/] rewrite 'wp-admin/css/' -> 'https://paramountbaldivis.com.au/wp-admin/css/', referer: binance.com
[Mon Nov 10 18:37:31.005862 2025] [rewrite:trace2] [pid 8734:tid 8806] mod_rewrite.c(505): [client 196.251.85.129:49173] 196.251.85.129 - - [paramountestate.com.au/sid#1b9c000][rid#7f74dc002970/initial] [perdir /home/paramount/public_html/] explicitly forcing redirect with https://paramountbaldivis.com.au/wp-admin/css/, referer: binance.com
[Mon Nov 10 18:37:31.005862 2025] [rewrite:trace2] [pid 8734:tid 8806] mod_rewrite.c(505): [client 196.251.85.129:49173] 196.251.85.129 - - [paramountestate.com.au/sid#1b9c000][rid#7f74dc002970/initial] [perdir /home/paramount/public_html/] setting lastsub to rule with output https://paramountbaldivis.com.au/$1, referer: binance.com
[Mon Nov 10 18:37:31.005885 2025] [rewrite:trace1] [pid 8734:tid 8806] mod_rewrite.c(505): [client 196.251.85.129:49173] 196.251.85.129 - - [paramountestate.com.au/sid#1b9c000][rid#7f74dc002970/initial] [perdir /home/paramount/public_html/] escaping https://paramountbaldivis.com.au/wp-admin/css/ for redirect, referer: binance.com
[Mon Nov 10 18:37:31.005891 2025] [rewrite:trace1] [pid 8734:tid 8806] mod_rewrite.c(505): [client 196.251.85.129:49173] 196.251.85.129 - - [paramountestate.com.au/sid#1b9c000][rid#7f74dc002970/initial] [perdir /home/paramount/public_html/] redirect to https://paramountbaldivis.com.au/wp-admin/css/ [REDIRECT/302], referer: binance.com
[Mon Nov 10 18:45:43.746971 2025] [:error] [pid 12498:tid 12574] [client 103.89.235.69:55145] [client 103.89.235.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.89.235.69, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRHCV5ftixy1okRgRrVq9gAAAJQ"]
[Mon Nov 10 18:45:43.752588 2025] [rewrite:trace3] [pid 12498:tid 12574] mod_rewrite.c(505): [client 103.89.235.69:55145] 103.89.235.69 - - [paramountestate.com.au/sid#36070d8][rid#7f80b8051a70/initial] [perdir /home/paramount/public_html/] strip per-dir prefix: /home/paramount/public_html/xmlrpc.php -> xmlrpc.php
[Mon Nov 10 18:45:43.752626 2025] [rewrite:trace3] [pid 12498:tid 12574] mod_rewrite.c(505): [client 103.89.235.69:55145] 103.89.235.69 - - [paramountestate.com.au/sid#36070d8][rid#7f80b8051a70/initial] [perdir /home/paramount/public_html/] applying pattern '^(.*)' to uri 'xmlrpc.php'
[Mon Nov 10 18:45:43.752640 2025] [rewrite:trace2] [pid 12498:tid 12574] mod_rewrite.c(505): [client 103.89.235.69:55145] 103.89.235.69 - - [paramountestate.com.au/sid#36070d8][rid#7f80b8051a70/initial] [perdir /home/paramount/public_html/] rewrite 'xmlrpc.php' -> 'https://paramountbaldivis.com.au/xmlrpc.php'
[Mon Nov 10 18:45:43.752676 2025] [rewrite:trace2] [pid 12498:tid 12574] mod_rewrite.c(505): [client 103.89.235.69:55145] 103.89.235.69 - - [paramountestate.com.au/sid#36070d8][rid#7f80b8051a70/initial] [perdir /home/paramount/public_html/] explicitly forcing redirect with https://paramountbaldivis.com.au/xmlrpc.php
[Mon Nov 10 18:45:43.752681 2025] [rewrite:trace2] [pid 12498:tid 12574] mod_rewrite.c(505): [client 103.89.235.69:55145] 103.89.235.69 - - [paramountestate.com.au/sid#36070d8][rid#7f80b8051a70/initial] [perdir /home/paramount/public_html/] setting lastsub to rule with output https://paramountbaldivis.com.au/$1
[Mon Nov 10 18:45:43.752692 2025] [rewrite:trace1] [pid 12498:tid 12574] mod_rewrite.c(505): [client 103.89.235.69:55145] 103.89.235.69 - - [paramountestate.com.au/sid#36070d8][rid#7f80b8051a70/initial] [perdir /home/paramount/public_html/] escaping https://paramountbaldivis.com.au/xmlrpc.php for redirect
[Mon Nov 10 18:45:43.752704 2025] [rewrite:trace1] [pid 12498:tid 12574] mod_rewrite.c(505): [client 103.89.235.69:55145] 103.89.235.69 - - [paramountestate.com.au/sid#36070d8][rid#7f80b8051a70/initial] [perdir /home/paramount/public_html/] redirect to https://paramountbaldivis.com.au/xmlrpc.php [REDIRECT/302]
[Mon Nov 10 21:27:00.781541 2025] [:error] [pid 31030:tid 31099] [client 34.51.112.190:54957] [client 34.51.112.190] ModSecurity: Access denied with code 403 (phase 2). Pattern match "(?:union(?:\\\\/\\\\*.{0,399}\\\\*\\\\/)?select)" at ARGS:selInfoKey1. [file "/usr/local/apache/modsecurity-cwaf/rules/30_Apps_OtherApps.conf"] [line "5662"] [id "220150"] [rev "5"] [msg "COMODO WAF: SQL injection vulnerability in Ginkgo CMS 5.0 (CVE-2013-5318)||www.paramountestate.com.au|F|2"] [data "1'unionselectmd5(31337)--"] [severity "CRITICAL"] [tag "CWAF"] [tag "OtherApps"] [hostname "www.paramountestate.com.au"] [uri "/nagiosql/admin/helpedit.php"] [unique_id "aRHoJDdQpWeECLLAfnZdVQAAAFc"]
[Mon Nov 10 21:27:00.798401 2025] [:error] [pid 31136:tid 31149] [client 34.51.112.190:54967] [client 34.51.112.190] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com.au|F|2"] [data ".dll"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com.au"] [uri "/moveitisapi/moveitisapi.dll"] [unique_id "aRHoJPtvd8w_jsstCaig6AAAAMg"]
[Tue Nov 11 00:59:10.255826 2025] [:error] [pid 41839:tid 41924] [client 91.92.242.56:60148] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com.au|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com.au"] [uri "/wp-content/debug.log"] [unique_id "aRIZ3jGxg5uCD9Nfh5W5UwAAAIo"]
[Tue Nov 11 01:30:52.720713 2025] [:error] [pid 24103:tid 24117] [client 91.92.242.56:62050] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/usc-e-shop/functions/content-log.php"] [unique_id "aRIhTLmrGVWhZHx4njJBKQAAAgs"]
[Tue Nov 11 01:38:37.113360 2025] [:error] [pid 24225:tid 24249] [client 91.92.242.56:49870] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/post-pdf-export/dompdf/dompdf.php"] [unique_id "aRIjHZ2rrdiHvhXEioV3hAAAAlA"]
[Tue Nov 11 01:38:41.853155 2025] [:error] [pid 24817:tid 24824] [client 91.92.242.56:56305] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/web-portal-lite-client-portal-secure-file-sharing-private-messaging/includes/libs/pdf/dompdf.php"] [unique_id "aRIjIeBo1Juuc7yq76DQhwAAAwU"]
[Tue Nov 11 01:38:44.254443 2025] [:error] [pid 24554:tid 24572] [client 91.92.242.56:60807] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-ecommerce-shop-styling/includes/download.php"] [unique_id "aRIjJBbgcg5JFvN-BGVynAAAAs4"]
[Tue Nov 11 01:38:45.318520 2025] [:error] [pid 24817:tid 24832] [client 91.92.242.56:65480] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIjJeBo1Juuc7yq76DQjQAAAw0"]
[Tue Nov 11 01:38:46.452032 2025] [:error] [pid 24554:tid 24566] [client 91.92.242.56:51059] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/cherry-plugin/admin/import-export/download-content.php"] [unique_id "aRIjJhbgcg5JFvN-BGVypwAAAsg"]
[Tue Nov 11 01:38:49.123471 2025] [:error] [pid 14120:tid 14131] [client 91.92.242.56:53292] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIjKST8OKKuPaCGMt0mRwAAAUk"]
[Tue Nov 11 01:38:51.134401 2025] [:error] [pid 24225:tid 24242] [client 91.92.242.56:60493] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "aRIjK52rrdiHvhXEioV3pAAAAkk"]
[Tue Nov 11 01:38:52.196530 2025] [:error] [pid 24554:tid 24559] [client 91.92.242.56:62792] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/mapsvg/gm_download.php"] [unique_id "aRIjLBbgcg5JFvN-BGVytAAAAsE"]
[Tue Nov 11 01:38:53.262125 2025] [:error] [pid 41825:tid 41890] [client 91.92.242.56:64789] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/mapsvg-lite-interactive-vector-maps/gm_download.php"] [unique_id "aRIjLYr5hkwmQG_pQgARQQAAAEM"]
[Tue Nov 11 08:05:34.804108 2025] [:error] [pid 33931:tid 33949] [client 91.92.242.56:57368] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com.au|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com.au"] [uri "/wp-content/debug.log"] [unique_id "aRJ9zknJb679KZEjo-MUIAAAAQk"]
[Tue Nov 11 08:34:33.846237 2025] [:error] [pid 33932:tid 33972] [client 91.92.242.56:62200] [client 91.92.242.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/usc-e-shop/functions/content-log.php"] [unique_id "aRKEmZdn2hP2rg5PoHKHgQAAAUU"]
[Tue Nov 11 10:19:59.339571 2025] [:error] [pid 53449:tid 53462] [client 172.192.26.78:17396] [client 172.192.26.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/info.php"] [unique_id "aRKdT9pz08j5NoUSzp--QQAAAUg"]
[Tue Nov 11 10:19:59.817032 2025] [:error] [pid 59670:tid 59681] [client 172.192.26.78:17298] [client 172.192.26.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/info.php"] [unique_id "aRKdT6k2Cnts0y-hpfp01QAAAIg"]
[Tue Nov 11 10:20:00.718062 2025] [:error] [pid 53356:tid 53390] [client 172.192.26.78:17299] [client 172.192.26.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/info.php"] [unique_id "aRKdUOkdmt0kzjVcUN9BRQAAAEU"]
[Tue Nov 11 10:20:01.441170 2025] [:error] [pid 53449:tid 53455] [client 172.192.26.78:17364] [client 172.192.26.78] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/info.php"] [unique_id "aRKdUdpz08j5NoUSzp--QgAAAUE"]
[Tue Nov 11 12:08:41.466883 2025] [:error] [pid 53355:tid 53381] [client 213.209.143.137:64392] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRK2yYB5X5A3rMc4_nD56gAAABc"]
[Tue Nov 11 12:08:41.985899 2025] [:error] [pid 53449:tid 53470] [client 213.209.143.137:49465] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRK2ydpz08j5NoUSzp_sowAAAVA"]
[Tue Nov 11 12:08:42.509862 2025] [:error] [pid 59670:tid 59696] [client 213.209.143.137:50657] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRK2yqk2Cnts0y-hpfqzTQAAAJc"]
[Tue Nov 11 14:37:09.149378 2025] [:error] [pid 53355:tid 53381] [client 209.38.83.143:36384] [client 209.38.83.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aRLZlYB5X5A3rMc4_nAtTwAAABc"]
[Tue Nov 11 14:37:09.295945 2025] [:error] [pid 53449:tid 53475] [client 209.38.83.143:34594] [client 209.38.83.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aRLZldpz08j5NoUSzp8owwAAAVU"]
[Tue Nov 11 20:20:32.339512 2025] [:error] [pid 36579:tid 36621] [client 131.161.66.165:50479] [client 131.161.66.165] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 131.161.66.165, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRMqEOmuedRSntjwLw6KUAAAAAo"]
[Tue Nov 11 22:10:18.727397 2025] [:error] [pid 47860:tid 47893] [client 213.209.143.137:61045] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRNDyqPe6bkmJWx80CzSHQAAAEI"]
[Tue Nov 11 22:10:19.246666 2025] [:error] [pid 47860:tid 47891] [client 213.209.143.137:64698] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRNDy6Pe6bkmJWx80CzSIQAAAEA"]
[Tue Nov 11 22:10:19.767432 2025] [:error] [pid 47964:tid 47971] [client 213.209.143.137:51741] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aRNDy16CQC3ebUS5pkQCjAAAAYQ"]
[Tue Nov 11 22:17:48.548577 2025] [:error] [pid 49628:tid 49648] [client 159.203.76.199:52160] [client 159.203.76.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aRNFjL82AgnfnwL7V2Y2XAAAAJI"]
[Wed Nov 12 00:24:56.924247 2025] [:error] [pid 54702:tid 55025] [client 159.203.76.199:35836] [client 159.203.76.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "aRNjWICgou0IW-jKFfmGAwAAAYs"]
[Wed Nov 12 03:03:34.155718 2025] [:error] [pid 40746:tid 40778] [client 209.38.83.143:37344] [client 209.38.83.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aROIhp75CjGFTLdEMn4LSwAAAEE"]
[Wed Nov 12 03:03:44.223883 2025] [:error] [pid 40745:tid 40764] [client 209.38.83.143:49138] [client 209.38.83.143] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aROIkMdgIR-a_T0XcdAp9QAAAA4"]
[Wed Nov 12 04:01:24.557843 2025] [:error] [pid 57223:tid 57266] [client 173.239.218.217:57977] [client 173.239.218.217] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.217, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aROWFBUU8_2aS__aG8YlOAAAAEk"]
[Wed Nov 12 04:21:28.722985 2025] [:error] [pid 57223:tid 57270] [client 213.209.143.137:51885] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROayBUU8_2aS__aG8YukQAAAE0"]
[Wed Nov 12 04:21:29.221997 2025] [:error] [pid 57223:tid 57271] [client 213.209.143.137:53176] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROayRUU8_2aS__aG8YukwAAAE4"]
[Wed Nov 12 04:21:29.726617 2025] [:error] [pid 57223:tid 57262] [client 213.209.143.137:54480] [client 213.209.143.137] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/excel-like-price-change-for-woocommerce-and-wp-e-commerce-light/readme.txt"] [unique_id "aROayRUU8_2aS__aG8YulwAAAEU"]
[Wed Nov 12 05:29:42.183898 2025] [:error] [pid 57223:tid 57258] [client 173.239.218.214:28851] [client 173.239.218.214] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.218.214, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aROqxhUU8_2aS__aG8ZE8gAAAEE"]
[Wed Nov 12 07:12:46.143905 2025] [:error] [pid 57224:tid 57296] [client 47.254.31.237:33728] [client 47.254.31.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aRPC7hs7oZ7imwCSdAkm9QAAAIw"]
[Wed Nov 12 07:12:46.686278 2025] [:error] [pid 57224:tid 57302] [client 47.254.31.237:33936] [client 47.254.31.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/api/.env"] [unique_id "aRPC7hs7oZ7imwCSdAkm-AAAAJI"]
[Wed Nov 12 07:12:47.332368 2025] [:error] [pid 57222:tid 57249] [client 47.254.31.237:34238] [client 47.254.31.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/env/.env"] [unique_id "aRPC72GJazH5XCcA91dLuwAAABY"]
[Wed Nov 12 07:12:48.142557 2025] [:error] [pid 32959:tid 32980] [client 47.254.31.237:35804] [client 47.254.31.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aRPC8Hoyrq7OJfcFnDj-mAAAARE"]
[Wed Nov 12 07:12:48.999594 2025] [:error] [pid 57223:tid 57276] [client 47.254.31.237:36158] [client 47.254.31.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/api/.env"] [unique_id "aRPC8BUU8_2aS__aG8ZmQgAAAFM"]
[Wed Nov 12 07:12:49.811013 2025] [:error] [pid 57312:tid 57332] [client 47.254.31.237:36456] [client 47.254.31.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/env/.env"] [unique_id "aRPC8Y0cuHgB17JK5qXpFwAAAM8"]
[Wed Nov 12 12:15:08.800780 2025] [:error] [pid 60095:tid 60114] [client 178.18.247.115:58974] [client 178.18.247.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.18.247.115, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRQJzHlw2elroagFF1rI3QAAAE8"], referer: binance.com
[Wed Nov 12 14:13:07.810313 2025] [:error] [pid 60096:tid 60128] [client 173.239.224.25:53787] [client 173.239.224.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.25, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aRQlczmzkhCvvk8DXOxaYQAAAII"]
[Wed Nov 12 22:28:02.011073 2025] [:error] [pid 12744:tid 12750] [client 45.153.34.41:49776] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aRSZcp1cp_ouUvkFj0WQ3AAAAQI"]
[Wed Nov 12 22:56:03.024665 2025] [:error] [pid 60096:tid 60127] [client 45.153.34.41:45094] [client 45.153.34.41] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aRSgAzmzkhCvvk8DXOzQJwAAAIE"]
[Thu Nov 13 17:55:44.761872 2025] [:error] [pid 62217:tid 62292] [client 150.241.107.255:56793] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aRWrIBjGU3T9wKBmdNc26AAAAFI"]
[Thu Nov 13 17:55:45.306317 2025] [:error] [pid 6086:tid 6090] [client 150.241.107.255:57081] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aRWrIX9_6CRZzjZnAe0zegAAAQE"]
[Thu Nov 13 17:55:45.853481 2025] [:error] [pid 62303:tid 62328] [client 150.241.107.255:57456] [client 150.241.107.255] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRWrIb-hlFTtVrZw8jDoQwAAAJU"]
[Thu Nov 13 20:14:52.932197 2025] [:error] [pid 62215:tid 62231] [client 38.114.122.142:50764] [client 38.114.122.142] ModSecurity: Access denied with code 403 (phase 2). Found 30 byte(s) in ARGS:_path outside range: 1-255. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||paramountestate.com.au|F|3"] [data "ARGS:_path=_controller=Symfony\\x5cComponent\\x5cYaml\\x5cInline::parse&value=!!php/object:a:1:{i:1;a:2:{i:0;O:32:\\x22Monolog\\x5cHandler\\x5cSyslogUdpHandler\\x22:1:{s:9:\\x22\\x00*\\x00socket\\x22;O:29:\\x22Monolog\\x5cHandler\\x5cBufferHandler\\x22:7:{s:10:\\x22\\x00*\\x00handler\\x22;O:29:\\x22Monolog\\x5cHandler\\x5cBufferHandler\\x22:7:{s:10:\\x22\\x00*\\x00handler\\x22;N;s:13:\\x22\\x00*\\x00bufferSize\\x22;i:-1;s:9:\\x22\\x00*\\x00buffer\\x22;a:1:{i:0;a:2:{i:0;s:2:\\x22-1\\x22;s:5:\\x22level\\x22;N;}}s:8:\\x22\\x00*\\x00level\\x22;N;s:14..."] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/_fragment"] [unique_id "aRXLvEvClof1c6XaOBXg2gAAAMw"]
[Fri Nov 14 00:01:48.865441 2025] [:error] [pid 4994:tid 5054] [client 68.154.21.129:48113] [client 68.154.21.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "aRYA7AVaYoYtjfBbabU0QQAAAIE"]
[Fri Nov 14 00:01:49.377552 2025] [:error] [pid 5086:tid 5097] [client 68.154.21.129:48102] [client 68.154.21.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "aRYA7R_dsYLFCHw574jUBgAAAQg"]
[Fri Nov 14 00:01:49.947749 2025] [:error] [pid 4992:tid 5001] [client 68.154.21.129:48070] [client 68.154.21.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "aRYA7SmsutP7nusdj-Co-AAAAMU"]
[Fri Nov 14 00:01:50.497502 2025] [:error] [pid 4994:tid 5076] [client 68.154.21.129:48078] [client 68.154.21.129] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "aRYA7gVaYoYtjfBbabU0RAAAAJc"]
[Fri Nov 14 01:18:14.251307 2025] [:error] [pid 56496:tid 56536] [client 159.223.72.153:51248] [client 159.223.72.153] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "aRYS1uh2ME7eucGJGGK3ugAAAAg"]
[Fri Nov 14 04:41:50.716664 2025] [:error] [pid 47154:tid 47160] [client 49.207.56.21:45827] [client 49.207.56.21] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.207.56.21, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRZCjkijA13A3g3ATrJOzAAAAAE"]
[Sat Nov 15 00:46:34.671056 2025] [:error] [pid 45907:tid 45932] [client 34.23.179.107:51652] [client 34.23.179.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "aRdc6lAqmYxCpnT9gJF16wAAAVU"]
[Sat Nov 15 00:53:57.037802 2025] [:error] [pid 18513:tid 18529] [client 49.150.102.20:56741] [client 49.150.102.20] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.150.102.20, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRdepfc94upQFzRWlUm1IAAAAEs"]
[Sat Nov 15 01:24:08.094599 2025] [:error] [pid 18513:tid 18532] [client 159.65.14.149:56683] [client 159.65.14.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "aRdluPc94upQFzRWlUnEfQAAAE4"]
[Sat Nov 15 03:50:03.411792 2025] [:error] [pid 10388:tid 10456] [client 4.205.238.136:39823] [client 4.205.238.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "aReH685Taslk19icHk5ErAAAAII"]
[Sat Nov 15 03:50:03.913013 2025] [:error] [pid 10388:tid 10462] [client 4.205.238.136:39935] [client 4.205.238.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "aReH685Taslk19icHk5EsAAAAIg"]
[Sat Nov 15 03:50:04.590490 2025] [:error] [pid 10489:tid 10498] [client 4.205.238.136:39907] [client 4.205.238.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "aReH7FckOpF1_1u6OZzETAAAAMQ"]
[Sat Nov 15 03:50:05.224815 2025] [:error] [pid 10388:tid 10457] [client 4.205.238.136:39900] [client 4.205.238.136] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "aReH7c5Taslk19icHk5EswAAAIM"]
[Sat Nov 15 05:04:16.536989 2025] [:error] [pid 27909:tid 27936] [client 162.243.15.109:45290] [client 162.243.15.109] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aReZUCTfZ6B57n8HepV-kAAAABc"]
[Sat Nov 15 05:04:17.585775 2025] [:error] [pid 37318:tid 37377] [client 162.243.15.109:45364] [client 162.243.15.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aReZUegM1rHoEAqoQDcQqgAAAQ8"]
[Sat Nov 15 05:04:18.448642 2025] [:error] [pid 27909:tid 27927] [client 162.243.15.109:45382] [client 162.243.15.109] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aReZUiTfZ6B57n8HepV-kwAAAA4"]
[Sat Nov 15 12:09:26.400406 2025] [:error] [pid 22765:tid 22782] [client 138.197.23.42:64635] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aRf89qbrQzjuZmPIWDafAQAAAow"]
[Sat Nov 15 12:09:26.828118 2025] [:error] [pid 27909:tid 27930] [client 138.197.23.42:64791] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aRf89iTfZ6B57n8HepXtLwAAABE"]
[Sat Nov 15 12:09:27.243427 2025] [:error] [pid 27911:tid 27988] [client 138.197.23.42:64944] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aRf898GzUdrhGBIfiKQmFgAAAJQ"]
[Sat Nov 15 12:09:27.668160 2025] [:error] [pid 22613:tid 22636] [client 138.197.23.42:65116] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aRf89yoyR3cDsIRGPRl8egAAAhU"]
[Sat Nov 15 12:09:28.085516 2025] [:error] [pid 20654:tid 20667] [client 138.197.23.42:65275] [client 138.197.23.42] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aRf8-HcS7eC8vO76_ydtugAAA4o"]
[Sat Nov 15 20:26:27.274672 2025] [:error] [pid 27911:tid 27977] [client 45.134.79.103:63787] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aRhxc8GzUdrhGBIfiKR17wAAAIk"]
[Sat Nov 15 20:26:27.911577 2025] [:error] [pid 22613:tid 22632] [client 45.134.79.103:64047] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aRhxcyoyR3cDsIRGPRnSVQAAAhE"]
[Sat Nov 15 20:26:28.557866 2025] [:error] [pid 20346:tid 20361] [client 45.134.79.103:64240] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRhxdJ7hsydZdIoVTltM2gAAAww"]
[Sat Nov 15 22:18:26.817144 2025] [:error] [pid 22765:tid 22784] [client 49.206.128.104:30351] [client 49.206.128.104] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.206.128.104, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRiLsqbrQzjuZmPIWDYTUwAAAo4"]
[Sat Nov 15 22:18:35.281199 2025] [:error] [pid 27909:tid 27926] [client 191.177.193.101:15134] [client 191.177.193.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 191.177.193.101, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRiLuyTfZ6B57n8HepVLPwAAAA0"]
[Sat Nov 15 22:25:18.180347 2025] [:error] [pid 19961:tid 20005] [client 157.51.16.188:37206] [client 157.51.16.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 157.51.16.188, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRiNTjar7Si-84EApVSStQAAAcw"]
[Mon Nov 17 18:23:25.283971 2025] [:error] [pid 15888:tid 15892] [client 164.100.214.27:32314] [client 164.100.214.27] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 164.100.214.27, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRr3nQjAdDTBm4W3qW0nvgAAAcE"]
[Tue Nov 18 01:37:55.490679 2025] [:error] [pid 40553:tid 40576] [client 51.57.73.118:36839] [client 51.57.73.118] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.57.73.118, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRtdc9uLE1BqoX0RcsLrlQAAAAc"], referer: https://www.yahoo.com/
[Tue Nov 18 05:45:47.240644 2025] [:error] [pid 29195:tid 29213] [client 152.42.168.23:65302] [client 152.42.168.23] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "aRuXixMeonxy_4yeOTUvogAAARA"]
[Tue Nov 18 09:54:34.740732 2025] [:error] [pid 61393:tid 61457] [client 104.234.19.146:61993] [client 104.234.19.146] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/txets.php"] [unique_id "aRvR2mH9XjlbVPv9gQVNxwAAAIE"]
[Tue Nov 18 09:54:35.220788 2025] [:error] [pid 28635:tid 28661] [client 104.234.19.150:22241] [client 104.234.19.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/txets.php"] [unique_id "aRvR22B61AnWhG54Xz3kKwAAAdc"]
[Tue Nov 18 09:54:35.700710 2025] [:error] [pid 29195:tid 29203] [client 216.24.219.22:33229] [client 216.24.219.22] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/txets.php"] [unique_id "aRvR2xMeonxy_4yeOTVrdwAAAQY"]
[Tue Nov 18 14:09:33.309993 2025] [:error] [pid 1387:tid 1412] [client 223.181.13.208:15178] [client 223.181.13.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.181.13.208, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRwNnUzBvalKyx3hMvX7UwAAABM"]
[Tue Nov 18 16:52:03.215181 2025] [:error] [pid 44624:tid 44634] [client 84.247.191.22:64959] [client 84.247.191.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/"] [unique_id "aRwzsyllffozoBluWCVXQQAAAYc"], referer: binance.com
[Tue Nov 18 21:37:31.164718 2025] [:error] [pid 3500:tid 3515] [client 45.134.79.103:51681] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aRx2m_CbRC7k2D7mjbSTuAAAAc0"]
[Tue Nov 18 21:37:31.817705 2025] [:error] [pid 44470:tid 44475] [client 45.134.79.103:59706] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aRx2mzv-RLYfULjlgDb_YAAAAEA"]
[Tue Nov 18 21:37:32.472375 2025] [:error] [pid 3500:tid 3502] [client 45.134.79.103:53478] [client 45.134.79.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "aRx2nPCbRC7k2D7mjbST5gAAAcA"]
[Wed Nov 19 03:02:06.068912 2025] [:error] [pid 43881:tid 43933] [client 20.171.87.215:53272] [client 20.171.87.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.171.87.215, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aRzCrn_TrIND5buvEyf7EgAAAVQ"], referer: https://www.google.fr/
[Wed Nov 19 03:02:33.093873 2025] [:error] [pid 43881:tid 43934] [client 20.171.87.215:53272] [client 20.171.87.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "aRzCyX_TrIND5buvEyf7OgAAAVU"], referer: https://www.google.co.uk/
[Wed Nov 19 03:02:59.845140 2025] [:error] [pid 14439:tid 14465] [client 20.171.87.215:18919] [client 20.171.87.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aRzC41at0cKFYVAxpdD2nAAAARg"], referer: https://www.bing.com/
[Wed Nov 19 03:03:23.717634 2025] [:error] [pid 43880:tid 43895] [client 20.171.87.215:50765] [client 20.171.87.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aRzC--1q1HNbKyNr9SaM3wAAAEo"], referer: https://www.google.co.uk/
[Wed Nov 19 07:30:38.673384 2025] [:error] [pid 6554:tid 6576] [client 18.191.165.250:56491] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR0Bnt8rvPWLafJFqmVW0wAAABA"]
[Wed Nov 19 07:30:39.073320 2025] [:error] [pid 6644:tid 6661] [client 18.191.165.250:56637] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR0Bn00i6Rf788MB6sbZwgAAAM8"]
[Wed Nov 19 07:30:39.463790 2025] [:error] [pid 6919:tid 6940] [client 18.191.165.250:56744] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR0Bn0YFdN1s_9xJVUmrJwAAARI"]
[Wed Nov 19 07:30:39.859986 2025] [:error] [pid 6555:tid 6612] [client 18.191.165.250:56822] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR0Bn0bVJm8eMsGMTCON0AAAAFU"]
[Wed Nov 19 07:30:40.250133 2025] [:error] [pid 6554:tid 6569] [client 18.191.165.250:56908] [client 18.191.165.250] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR0BoN8rvPWLafJFqmVW_wAAAAk"]
[Wed Nov 19 08:23:24.369202 2025] [:error] [pid 6644:tid 6646] [client 169.224.104.152:39758] [client 169.224.104.152] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 169.224.104.152, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aR0N_E0i6Rf788MB6sbpVAAAAMA"]
[Wed Nov 19 20:35:57.958719 2025] [:error] [pid 12643:tid 12661] [client 104.196.176.201:58231] [client 104.196.176.201] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/media/system/js/core.js"] [unique_id "aR25rcaLCNSdLHNAGt73PwAAAY8"]
[Thu Nov 20 02:21:50.928498 2025] [:error] [pid 8909:tid 8962] [client 91.92.242.56:57661] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-event-solution/readme.txt"] [unique_id "aR4KvmnKNOWZ-UbT97B3CQAAA9c"]
[Thu Nov 20 02:21:57.864315 2025] [:error] [pid 8909:tid 8950] [client 91.92.242.56:58039] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/user-registration-pro/readme.txt"] [unique_id "aR4KxWnKNOWZ-UbT97B3GAAAA8s"]
[Thu Nov 20 02:21:58.440975 2025] [:error] [pid 50210:tid 50310] [client 91.92.242.56:62200] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/user-registration-pro/readme.txt"] [unique_id "aR4Kxt9KVfTGhSw-ebu_3AAAAAQ"]
[Thu Nov 20 02:21:59.003183 2025] [:error] [pid 8872:tid 8892] [client 91.92.242.56:62581] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/user-registration-pro/readme.txt"] [unique_id "aR4KxzkBDH0q-89RJLFH0wAAA1E"]
[Thu Nov 20 02:21:59.589964 2025] [:error] [pid 8396:tid 8408] [client 91.92.242.56:62886] [client 91.92.242.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/user-registration-pro/readme.txt"] [unique_id "aR4Kx4olA09HZQNzyMD08AAAAso"]
[Thu Nov 20 10:23:58.329685 2025] [:error] [pid 55430:tid 55449] [client 89.185.82.43:39234] [client 89.185.82.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "aR57vvPZXaIMEU4pE7uHagAAANA"]
[Thu Nov 20 12:10:22.169847 2025] [:error] [pid 55430:tid 55441] [client 98.81.111.26:50801] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR6UrvPZXaIMEU4pE7ugsgAAAMg"]
[Thu Nov 20 12:10:22.582871 2025] [:error] [pid 55342:tid 55392] [client 98.81.111.26:53088] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR6Urrg6x32Tvk7fIG-L-wAAAFQ"]
[Thu Nov 20 12:10:22.991335 2025] [:error] [pid 55430:tid 55440] [client 98.81.111.26:63557] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR6UrvPZXaIMEU4pE7ug7AAAAMc"]
[Thu Nov 20 12:10:23.418822 2025] [:error] [pid 804:tid 836] [client 98.81.111.26:63594] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR6Ur_aRHpUlPL9O0Lk16wAAAYw"]
[Thu Nov 20 12:10:23.857932 2025] [:error] [pid 34405:tid 34427] [client 98.81.111.26:57071] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR6UrzFpvu8oRK7ATfvJdgAAARQ"]
[Thu Nov 20 12:15:52.122827 2025] [:error] [pid 55342:tid 55384] [client 98.81.111.26:60364] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR6V-Lg6x32Tvk7fIG-PKAAAAEw"]
[Thu Nov 20 12:15:52.527437 2025] [:error] [pid 34405:tid 34413] [client 98.81.111.26:62864] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR6V-DFpvu8oRK7ATfvNJwAAAQY"]
[Thu Nov 20 12:15:52.939168 2025] [:error] [pid 55430:tid 55440] [client 98.81.111.26:65052] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR6V-PPZXaIMEU4pE7umKwAAAMc"]
[Thu Nov 20 12:15:53.349870 2025] [:error] [pid 55343:tid 55404] [client 98.81.111.26:50801] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR6V-VWlO3EnyVMV7w5o2AAAAIU"]
[Thu Nov 20 12:15:53.755351 2025] [:error] [pid 34444:tid 34462] [client 98.81.111.26:52748] [client 98.81.111.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aR6V-VNEol4jlmmA_GP0rgAAAVA"]
[Thu Nov 20 13:02:47.181676 2025] [:error] [pid 55343:tid 55412] [client 85.8.130.84:43565] [client 85.8.130.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 85.8.130.84, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aR6g91WlO3EnyVMV7w51NQAAAI0"]
[Thu Nov 20 20:12:21.391795 2025] [:error] [pid 55430:tid 55456] [client 48.218.7.25:17280] [client 48.218.7.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aR8FpfPZXaIMEU4pE7sQFgAAANc"]
[Thu Nov 20 20:12:22.309799 2025] [:error] [pid 40445:tid 40480] [client 48.218.7.25:17289] [client 48.218.7.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aR8FplH-MuFcoWRjXpZ1BgAAAkU"]
[Thu Nov 20 20:12:24.954671 2025] [:error] [pid 40537:tid 40549] [client 48.218.7.25:17357] [client 48.218.7.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aR8FqKKlsL5kxTa3c1zyCgAAAsg"]
[Thu Nov 20 20:12:26.157846 2025] [:error] [pid 55342:tid 55376] [client 48.218.7.25:17378] [client 48.218.7.25] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aR8Fqrg6x32Tvk7fIG_wFgAAAEQ"]
[Thu Nov 20 23:08:03.173440 2025] [:error] [pid 55430:tid 55442] [client 103.176.11.32:60123] [client 103.176.11.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.176.11.32, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aR8u0_PZXaIMEU4pE7svAwAAAMk"]
[Fri Nov 21 14:45:51.314434 2025] [:error] [pid 25430:tid 25464] [client 213.21.239.4:60498] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aSAKn6pnWJcWt_4foXkXGgAAAEQ"]
[Fri Nov 21 15:11:00.398536 2025] [:error] [pid 25431:tid 25497] [client 213.21.239.4:44854] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "aSAQhMklhXxmoIExII0LhQAAAIo"]
[Fri Nov 21 15:44:53.669598 2025] [:error] [pid 25431:tid 25490] [client 213.21.239.4:45572] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.svn/wc.db"] [unique_id "aSAYdcklhXxmoIExII0dlwAAAIM"]
[Fri Nov 21 16:10:01.761538 2025] [:error] [pid 25554:tid 25568] [client 213.21.239.4:54802] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.svn/wc.db"] [unique_id "aSAeWR-NtB-9AzFZrk5clgAAAQo"]
[Fri Nov 21 20:12:53.800741 2025] [:error] [pid 25431:tid 25511] [client 124.217.53.252:26411] [client 124.217.53.252] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 124.217.53.252, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSBXRcklhXxmoIExII2LKQAAAJg"]
[Fri Nov 21 20:14:52.638746 2025] [:error] [pid 25431:tid 25487] [client 196.216.80.124:49345] [client 196.216.80.124] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.216.80.124, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSBXvMklhXxmoIExII2LvQAAAIA"]
[Sat Nov 22 06:56:51.058209 2025] [:error] [pid 53566:tid 53585] [client 212.116.231.26:46470] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/manager.php"] [unique_id "aSDuM8bSHDBkRbwMbd5n4wAAANE"]
[Sat Nov 22 06:56:51.890748 2025] [:error] [pid 53477:tid 53487] [client 212.116.231.26:46996] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/manager.php"] [unique_id "aSDuM37Lu30Ku9O40aIHLwAAAAY"]
[Sat Nov 22 06:56:52.725423 2025] [:error] [pid 53479:tid 53550] [client 212.116.231.26:47406] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/manager.php"] [unique_id "aSDuNG6cicFF3Aas-oSh2wAAAI4"]
[Sat Nov 22 06:56:53.536168 2025] [:error] [pid 53477:tid 53504] [client 212.116.231.26:47878] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/manager.php"] [unique_id "aSDuNX7Lu30Ku9O40aIHPwAAABc"]
[Sat Nov 22 06:56:54.353619 2025] [:error] [pid 53566:tid 53584] [client 212.116.231.26:48276] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/manager.php"] [unique_id "aSDuNsbSHDBkRbwMbd5oCwAAANA"]
[Sat Nov 22 06:56:55.188838 2025] [:error] [pid 53566:tid 53591] [client 212.116.231.26:48638] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuN8bSHDBkRbwMbd5oGgAAANc"]
[Sat Nov 22 06:56:55.999883 2025] [:error] [pid 53477:tid 53490] [client 212.116.231.26:48926] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuN37Lu30Ku9O40aIHbgAAAAk"]
[Sat Nov 22 06:56:56.812143 2025] [:error] [pid 53477:tid 53505] [client 212.116.231.26:49156] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuOH7Lu30Ku9O40aIHcgAAABg"]
[Sat Nov 22 06:56:57.626356 2025] [:error] [pid 53566:tid 53582] [client 212.116.231.26:49320] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuOcbSHDBkRbwMbd5oLAAAAM4"]
[Sat Nov 22 06:56:58.460449 2025] [:error] [pid 53566:tid 53580] [client 212.116.231.26:49446] [client 212.116.231.26] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSDuOsbSHDBkRbwMbd5oLwAAAMw"]
[Sat Nov 22 17:52:47.800923 2025] [:error] [pid 53479:tid 53558] [client 103.204.38.151:50739] [client 103.204.38.151] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.204.38.151, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSGH726cicFF3Aas-oR8twAAAJY"]
[Sat Nov 22 22:39:13.409322 2025] [:error] [pid 53566:tid 53587] [client 48.210.12.181:11538] [client 48.210.12.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "aSHLEcbSHDBkRbwMbd5wuAAAANM"]
[Sat Nov 22 22:39:21.998157 2025] [:error] [pid 53477:tid 53486] [client 48.210.12.181:11271] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "aSHLGX7Lu30Ku9O40aL-0wAAAAU"]
[Sat Nov 22 22:39:22.890918 2025] [:error] [pid 25856:tid 25868] [client 48.210.12.181:11574] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "aSHLGhsTP0wy94zKUvEClQAAAQo"]
[Sat Nov 22 22:39:23.581329 2025] [:error] [pid 53478:tid 53513] [client 48.210.12.181:11547] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "aSHLGwhUYdXBbQswAdQ4wgAAAEQ"]
[Sat Nov 22 22:39:24.250680 2025] [:error] [pid 44259:tid 44280] [client 48.210.12.181:11576] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "aSHLHHXe1xL-_YOdRmTl5gAAAZI"]
[Sat Nov 22 22:39:25.988497 2025] [:error] [pid 44259:tid 44285] [client 48.210.12.181:11527] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file7.php"] [unique_id "aSHLHXXe1xL-_YOdRmTl8AAAAZc"]
[Sat Nov 22 22:39:26.966077 2025] [:error] [pid 9547:tid 9564] [client 48.210.12.181:11541] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file7.php"] [unique_id "aSHLHtClOR5qk7DoMeEOYwAAAUs"]
[Sat Nov 22 22:39:27.565505 2025] [:error] [pid 9547:tid 9571] [client 48.210.12.181:11578] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file7.php"] [unique_id "aSHLH9ClOR5qk7DoMeEOZwAAAVI"]
[Sat Nov 22 22:39:28.156469 2025] [:error] [pid 44259:tid 44278] [client 48.210.12.181:11284] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file7.php"] [unique_id "aSHLIHXe1xL-_YOdRmTl8gAAAZA"]
[Sat Nov 22 22:39:29.446327 2025] [:error] [pid 9547:tid 9570] [client 48.210.12.181:11266] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gmo.php"] [unique_id "aSHLIdClOR5qk7DoMeEOaQAAAVE"]
[Sat Nov 22 22:39:29.887121 2025] [:error] [pid 53478:tid 53519] [client 48.210.12.181:11290] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gmo.php"] [unique_id "aSHLIQhUYdXBbQswAdQ4xgAAAEo"]
[Sat Nov 22 22:39:31.154565 2025] [:error] [pid 44259:tid 44282] [client 48.210.12.181:11542] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gmo.php"] [unique_id "aSHLI3Xe1xL-_YOdRmTl9QAAAZQ"]
[Sat Nov 22 22:39:32.034533 2025] [:error] [pid 53477:tid 53502] [client 48.210.12.181:11546] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gmo.php"] [unique_id "aSHLJH7Lu30Ku9O40aL-9AAAABU"]
[Sat Nov 22 22:39:33.231057 2025] [:error] [pid 44259:tid 44267] [client 48.210.12.181:11274] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless2.php"] [unique_id "aSHLJXXe1xL-_YOdRmTl9wAAAYU"]
[Sat Nov 22 22:39:33.890026 2025] [:error] [pid 53566:tid 53573] [client 48.210.12.181:11268] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless2.php"] [unique_id "aSHLJcbSHDBkRbwMbd5wxgAAAMU"]
[Sat Nov 22 22:39:34.599645 2025] [:error] [pid 25856:tid 25881] [client 48.210.12.181:11577] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless2.php"] [unique_id "aSHLJhsTP0wy94zKUvECoQAAARc"]
[Sat Nov 22 22:39:35.476315 2025] [:error] [pid 44259:tid 44278] [client 48.210.12.181:11562] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless2.php"] [unique_id "aSHLJ3Xe1xL-_YOdRmTl_wAAAZA"]
[Sat Nov 22 22:39:36.240414 2025] [:error] [pid 9547:tid 9574] [client 48.210.12.181:11531] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "aSHLKNClOR5qk7DoMeEOcwAAAVU"]
[Sat Nov 22 22:39:37.340925 2025] [:error] [pid 44259:tid 44282] [client 48.210.12.181:11304] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "aSHLKXXe1xL-_YOdRmTmBQAAAZQ"]
[Sat Nov 22 22:39:38.035582 2025] [:error] [pid 44259:tid 44267] [client 48.210.12.181:11580] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "aSHLKnXe1xL-_YOdRmTmBgAAAYU"]
[Sat Nov 22 22:39:39.071855 2025] [:error] [pid 53566:tid 53590] [client 48.210.12.181:11471] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "aSHLK8bSHDBkRbwMbd5wyQAAANY"]
[Sat Nov 22 22:39:40.146618 2025] [:error] [pid 9547:tid 9572] [client 48.210.12.181:11550] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-class.php"] [unique_id "aSHLLNClOR5qk7DoMeEOdQAAAVM"]
[Sat Nov 22 22:39:41.162932 2025] [:error] [pid 44259:tid 44278] [client 48.210.12.181:11573] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-class.php"] [unique_id "aSHLLXXe1xL-_YOdRmTmCwAAAZA"]
[Sat Nov 22 22:39:42.027167 2025] [:error] [pid 44259:tid 44266] [client 48.210.12.181:11553] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-class.php"] [unique_id "aSHLLnXe1xL-_YOdRmTmDwAAAYQ"]
[Sat Nov 22 22:39:42.961726 2025] [:error] [pid 9547:tid 9564] [client 48.210.12.181:11565] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-class.php"] [unique_id "aSHLLtClOR5qk7DoMeEOfAAAAUs"]
[Sat Nov 22 22:39:44.327649 2025] [:error] [pid 53479:tid 53552] [client 48.210.12.181:11521] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wsa.php"] [unique_id "aSHLMG6cicFF3Aas-oTd6gAAAJA"]
[Sat Nov 22 22:39:44.891812 2025] [:error] [pid 53479:tid 53539] [client 48.210.12.181:11552] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wsa.php"] [unique_id "aSHLMG6cicFF3Aas-oTd7AAAAIM"]
[Sat Nov 22 22:39:45.554724 2025] [:error] [pid 25856:tid 25877] [client 48.210.12.181:11539] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wsa.php"] [unique_id "aSHLMRsTP0wy94zKUvECqAAAARM"]
[Sat Nov 22 22:39:46.681131 2025] [:error] [pid 9547:tid 9572] [client 48.210.12.181:11283] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wsa.php"] [unique_id "aSHLMtClOR5qk7DoMeEOgAAAAVM"]
[Sat Nov 22 22:39:47.455112 2025] [:error] [pid 9547:tid 9576] [client 48.210.12.181:11581] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/z.php"] [unique_id "aSHLM9ClOR5qk7DoMeEOgwAAAVc"]
[Sat Nov 22 22:39:48.318032 2025] [:error] [pid 53477:tid 53490] [client 48.210.12.181:11292] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/z.php"] [unique_id "aSHLNH7Lu30Ku9O40aL_GgAAAAk"]
[Sat Nov 22 22:39:49.627780 2025] [:error] [pid 44259:tid 44264] [client 48.210.12.181:11582] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/z.php"] [unique_id "aSHLNXXe1xL-_YOdRmTmGAAAAYI"]
[Sat Nov 22 22:39:50.307063 2025] [:error] [pid 53479:tid 53541] [client 48.210.12.181:11275] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/z.php"] [unique_id "aSHLNm6cicFF3Aas-oTd7gAAAIU"]
[Sat Nov 22 22:39:50.988797 2025] [:error] [pid 53478:tid 53511] [client 48.210.12.181:11558] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nc4.php"] [unique_id "aSHLNghUYdXBbQswAdQ46AAAAEI"]
[Sat Nov 22 22:39:51.704360 2025] [:error] [pid 53479:tid 53539] [client 48.210.12.181:11528] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nc4.php"] [unique_id "aSHLN26cicFF3Aas-oTd8gAAAIM"]
[Sat Nov 22 22:39:52.449711 2025] [:error] [pid 53479:tid 53553] [client 48.210.12.181:11298] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nc4.php"] [unique_id "aSHLOG6cicFF3Aas-oTd8wAAAJE"]
[Sat Nov 22 22:39:53.500111 2025] [:error] [pid 9547:tid 9577] [client 48.210.12.181:11555] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nc4.php"] [unique_id "aSHLOdClOR5qk7DoMeEOiAAAAVg"]
[Sat Nov 22 22:39:54.719738 2025] [:error] [pid 9547:tid 9568] [client 48.210.12.181:11285] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ahax.php"] [unique_id "aSHLOtClOR5qk7DoMeEOjgAAAU8"]
[Sat Nov 22 22:39:56.369471 2025] [:error] [pid 53479:tid 53549] [client 48.210.12.181:11457] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ahax.php"] [unique_id "aSHLPG6cicFF3Aas-oTd_gAAAI0"]
[Sat Nov 22 22:39:58.283015 2025] [:error] [pid 53479:tid 53542] [client 48.210.12.181:11545] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ahax.php"] [unique_id "aSHLPm6cicFF3Aas-oTeAQAAAIY"]
[Sat Nov 22 22:39:59.571655 2025] [:error] [pid 53566:tid 53584] [client 48.210.12.181:11277] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ahax.php"] [unique_id "aSHLP8bSHDBkRbwMbd5w3AAAANA"]
[Sat Nov 22 22:40:01.039225 2025] [:error] [pid 53479:tid 53546] [client 48.210.12.181:11564] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dejavu.php"] [unique_id "aSHLQW6cicFF3Aas-oTeBgAAAIo"]
[Sat Nov 22 22:40:01.762767 2025] [:error] [pid 44259:tid 44266] [client 48.210.12.181:11272] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dejavu.php"] [unique_id "aSHLQXXe1xL-_YOdRmTmIwAAAYQ"]
[Sat Nov 22 22:40:03.038658 2025] [:error] [pid 44259:tid 44282] [client 48.210.12.181:11530] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dejavu.php"] [unique_id "aSHLQ3Xe1xL-_YOdRmTmKAAAAZQ"]
[Sat Nov 22 22:40:03.596755 2025] [:error] [pid 53479:tid 53557] [client 48.210.12.181:11583] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dejavu.php"] [unique_id "aSHLQ26cicFF3Aas-oTeCwAAAJU"]
[Sat Nov 22 22:40:04.565461 2025] [:error] [pid 44259:tid 44283] [client 48.210.12.181:11264] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/config.php"] [unique_id "aSHLRHXe1xL-_YOdRmTmLAAAAZU"]
[Sat Nov 22 22:40:05.428891 2025] [:error] [pid 53566:tid 53576] [client 48.210.12.181:11568] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/config.php"] [unique_id "aSHLRcbSHDBkRbwMbd5w4QAAAMg"]
[Sat Nov 22 22:40:05.766872 2025] [:error] [pid 53477:tid 53494] [client 48.210.12.181:11529] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/config.php"] [unique_id "aSHLRX7Lu30Ku9O40aL_UwAAAA0"]
[Sat Nov 22 22:40:06.203423 2025] [:error] [pid 53566:tid 53581] [client 48.210.12.181:11311] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/config.php"] [unique_id "aSHLRsbSHDBkRbwMbd5w4wAAAM0"]
[Sat Nov 22 22:40:07.398981 2025] [:error] [pid 53479:tid 53539] [client 48.210.12.181:11313] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/atomlib.php"] [unique_id "aSHLR26cicFF3Aas-oTeDgAAAIM"]
[Sat Nov 22 22:40:07.771255 2025] [:error] [pid 53479:tid 53553] [client 48.210.12.181:11549] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/atomlib.php"] [unique_id "aSHLR26cicFF3Aas-oTeDwAAAJE"]
[Sat Nov 22 22:40:08.185234 2025] [:error] [pid 53478:tid 53531] [client 48.210.12.181:11522] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/atomlib.php"] [unique_id "aSHLSAhUYdXBbQswAdQ48gAAAFY"]
[Sat Nov 22 22:40:08.612286 2025] [:error] [pid 9547:tid 9566] [client 48.210.12.181:11535] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/atomlib.php"] [unique_id "aSHLSNClOR5qk7DoMeEOngAAAU0"]
[Sat Nov 22 22:40:09.469076 2025] [:error] [pid 53566:tid 53573] [client 48.210.12.181:11282] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css.php"] [unique_id "aSHLScbSHDBkRbwMbd5w5QAAAMU"]
[Sat Nov 22 22:40:10.138648 2025] [:error] [pid 53477:tid 53487] [client 48.210.12.181:11294] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css.php"] [unique_id "aSHLSn7Lu30Ku9O40aL_VgAAAAY"]
[Sat Nov 22 22:40:10.565631 2025] [:error] [pid 53479:tid 53543] [client 48.210.12.181:11267] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css.php"] [unique_id "aSHLSm6cicFF3Aas-oTeEQAAAIc"]
[Sat Nov 22 22:40:11.287854 2025] [:error] [pid 9547:tid 9561] [client 48.210.12.181:11315] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css.php"] [unique_id "aSHLS9ClOR5qk7DoMeEOoQAAAUg"]
[Sat Nov 22 22:40:11.625590 2025] [:error] [pid 25856:tid 25865] [client 48.210.12.181:11317] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/past.php"] [unique_id "aSHLSxsTP0wy94zKUvECwgAAAQc"]
[Sat Nov 22 22:40:12.169171 2025] [:error] [pid 53479:tid 53546] [client 48.210.12.181:11488] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/past.php"] [unique_id "aSHLTG6cicFF3Aas-oTeFAAAAIo"]
[Sat Nov 22 22:40:12.805800 2025] [:error] [pid 53479:tid 53554] [client 48.210.12.181:11273] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/past.php"] [unique_id "aSHLTG6cicFF3Aas-oTeFQAAAJI"]
[Sat Nov 22 22:40:13.379086 2025] [:error] [pid 53566:tid 53584] [client 48.210.12.181:11554] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/past.php"] [unique_id "aSHLTcbSHDBkRbwMbd5w6AAAANA"]
[Sat Nov 22 22:40:13.670261 2025] [:error] [pid 53479:tid 53547] [client 48.210.12.181:11281] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "aSHLTW6cicFF3Aas-oTeFgAAAIs"]
[Sat Nov 22 22:40:14.375050 2025] [:error] [pid 53566:tid 53572] [client 48.210.12.181:11540] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "aSHLTsbSHDBkRbwMbd5w6QAAAMQ"]
[Sat Nov 22 22:40:14.963448 2025] [:error] [pid 53479:tid 53544] [client 48.210.12.181:11560] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "aSHLTm6cicFF3Aas-oTeGAAAAIg"]
[Sat Nov 22 22:40:15.738376 2025] [:error] [pid 53478:tid 53533] [client 48.210.12.181:11543] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "aSHLTwhUYdXBbQswAdQ4-AAAAFg"]
[Sat Nov 22 22:40:16.175898 2025] [:error] [pid 53566:tid 53576] [client 48.210.12.181:11548] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ol.php"] [unique_id "aSHLUMbSHDBkRbwMbd5w7AAAAMg"]
[Sat Nov 22 22:40:16.855044 2025] [:error] [pid 44259:tid 44281] [client 48.210.12.181:11300] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ol.php"] [unique_id "aSHLUHXe1xL-_YOdRmTmOQAAAZM"]
[Sat Nov 22 22:40:17.656804 2025] [:error] [pid 53566:tid 53578] [client 48.210.12.181:11579] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ol.php"] [unique_id "aSHLUcbSHDBkRbwMbd5w7QAAAMo"]
[Sat Nov 22 22:40:19.862164 2025] [:error] [pid 9547:tid 9567] [client 48.210.12.181:11483] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ol.php"] [unique_id "aSHLU9ClOR5qk7DoMeEOpgAAAU4"]
[Sat Nov 22 22:40:39.490141 2025] [:error] [pid 53477:tid 53486] [client 48.210.12.181:11312] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "aSHLZ37Lu30Ku9O40aL_cAAAAAU"]
[Sat Nov 22 22:40:40.460783 2025] [:error] [pid 25856:tid 25882] [client 48.210.12.181:11279] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "aSHLaBsTP0wy94zKUvEC-gAAARg"]
[Sat Nov 22 22:40:40.818337 2025] [:error] [pid 53477:tid 53504] [client 48.210.12.181:11534] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "aSHLaH7Lu30Ku9O40aL_cQAAABc"]
[Sat Nov 22 22:40:41.798516 2025] [:error] [pid 53478:tid 53530] [client 48.210.12.181:11305] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "aSHLaQhUYdXBbQswAdQ5DAAAAFU"]
[Sat Nov 22 22:40:42.413162 2025] [:error] [pid 53479:tid 53556] [client 48.210.12.181:11458] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/num.php"] [unique_id "aSHLam6cicFF3Aas-oTeJAAAAJQ"]
[Sat Nov 22 22:40:43.015391 2025] [:error] [pid 53566:tid 53573] [client 48.210.12.181:11472] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/num.php"] [unique_id "aSHLa8bSHDBkRbwMbd5w_gAAAMU"]
[Sat Nov 22 22:40:43.497412 2025] [:error] [pid 9547:tid 9563] [client 48.210.12.181:11459] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/num.php"] [unique_id "aSHLa9ClOR5qk7DoMeEOsgAAAUo"]
[Sat Nov 22 22:40:44.126986 2025] [:error] [pid 25856:tid 25881] [client 48.210.12.181:11568] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/num.php"] [unique_id "aSHLbBsTP0wy94zKUvEC_QAAARc"]
[Sat Nov 22 22:40:45.108052 2025] [:error] [pid 9547:tid 9574] [client 48.210.12.181:11556] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/astab.php"] [unique_id "aSHLbdClOR5qk7DoMeEOtAAAAVU"]
[Sat Nov 22 22:40:45.845834 2025] [:error] [pid 53479:tid 53553] [client 48.210.12.181:11532] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/astab.php"] [unique_id "aSHLbW6cicFF3Aas-oTeJgAAAJE"]
[Sat Nov 22 22:40:46.303099 2025] [:error] [pid 25856:tid 25880] [client 48.210.12.181:11557] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/astab.php"] [unique_id "aSHLbhsTP0wy94zKUvEC_gAAARY"]
[Sat Nov 22 22:40:47.396781 2025] [:error] [pid 44259:tid 44281] [client 48.210.12.181:11288] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/astab.php"] [unique_id "aSHLb3Xe1xL-_YOdRmTmdgAAAZM"]
[Sat Nov 22 22:40:48.087609 2025] [:error] [pid 44259:tid 44275] [client 48.210.12.181:11492] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xl.php"] [unique_id "aSHLcHXe1xL-_YOdRmTmeAAAAY0"]
[Sat Nov 22 22:40:48.809189 2025] [:error] [pid 9547:tid 9555] [client 48.210.12.181:11523] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xl.php"] [unique_id "aSHLcNClOR5qk7DoMeEOtQAAAUI"]
[Sat Nov 22 22:40:49.625793 2025] [:error] [pid 44259:tid 44277] [client 48.210.12.181:11282] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xl.php"] [unique_id "aSHLcXXe1xL-_YOdRmTmfgAAAY8"]
[Sat Nov 22 22:40:50.702903 2025] [:error] [pid 44259:tid 44274] [client 48.210.12.181:11509] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xl.php"] [unique_id "aSHLcnXe1xL-_YOdRmTmgAAAAYw"]
[Sat Nov 22 22:40:51.113980 2025] [:error] [pid 25856:tid 25866] [client 48.210.12.181:11296] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file17.php"] [unique_id "aSHLcxsTP0wy94zKUvEDAAAAAQg"]
[Sat Nov 22 22:40:51.845115 2025] [:error] [pid 53477:tid 53481] [client 48.210.12.181:11302] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file17.php"] [unique_id "aSHLc37Lu30Ku9O40aL_eQAAAAA"]
[Sat Nov 22 22:40:52.833132 2025] [:error] [pid 9547:tid 9568] [client 48.210.12.181:11495] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file17.php"] [unique_id "aSHLdNClOR5qk7DoMeEOtgAAAU8"]
[Sat Nov 22 22:40:54.014394 2025] [:error] [pid 53479:tid 53560] [client 48.210.12.181:11486] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file17.php"] [unique_id "aSHLdm6cicFF3Aas-oTeKAAAAJg"]
[Sat Nov 22 22:40:55.480878 2025] [:error] [pid 25856:tid 25879] [client 48.210.12.181:11477] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/pepe.php"] [unique_id "aSHLdxsTP0wy94zKUvEDAgAAARU"]
[Sat Nov 22 22:40:55.980810 2025] [:error] [pid 53477:tid 53483] [client 48.210.12.181:11467] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/pepe.php"] [unique_id "aSHLd37Lu30Ku9O40aL_fQAAAAI"]
[Sat Nov 22 22:40:56.813331 2025] [:error] [pid 53566:tid 53584] [client 48.210.12.181:11307] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/pepe.php"] [unique_id "aSHLeMbSHDBkRbwMbd5xCgAAANA"]
[Sat Nov 22 22:40:57.365804 2025] [:error] [pid 53478:tid 53518] [client 48.210.12.181:11520] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/pepe.php"] [unique_id "aSHLeQhUYdXBbQswAdQ5FQAAAEk"]
[Sat Nov 22 22:40:58.127956 2025] [:error] [pid 9547:tid 9558] [client 48.210.12.181:11476] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "aSHLetClOR5qk7DoMeEOuwAAAUU"]
[Sat Nov 22 22:40:59.424387 2025] [:error] [pid 53477:tid 53500] [client 48.210.12.181:11551] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "aSHLe37Lu30Ku9O40aL_gQAAABM"]
[Sat Nov 22 22:41:01.659848 2025] [:error] [pid 53478:tid 53528] [client 48.210.12.181:11463] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "aSHLfQhUYdXBbQswAdQ5GQAAAFM"]
[Sat Nov 22 22:41:02.158989 2025] [:error] [pid 9547:tid 9563] [client 48.210.12.181:11570] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "aSHLftClOR5qk7DoMeEOwAAAAUo"]
[Sat Nov 22 22:41:02.894178 2025] [:error] [pid 53478:tid 53510] [client 48.210.12.181:12263] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "aSHLfghUYdXBbQswAdQ5HAAAAEE"]
[Sat Nov 22 22:41:03.630968 2025] [:error] [pid 44259:tid 44285] [client 48.210.12.181:11295] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "aSHLf3Xe1xL-_YOdRmTmjgAAAZc"]
[Sat Nov 22 22:41:04.325120 2025] [:error] [pid 53479:tid 53557] [client 48.210.12.181:11462] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "aSHLgG6cicFF3Aas-oTeMgAAAJU"]
[Sat Nov 22 22:41:05.343166 2025] [:error] [pid 53479:tid 53548] [client 48.210.12.181:11276] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "aSHLgW6cicFF3Aas-oTeMwAAAIw"]
[Sat Nov 22 22:41:06.183856 2025] [:error] [pid 44259:tid 44283] [client 48.210.12.181:11507] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless.php"] [unique_id "aSHLgnXe1xL-_YOdRmTmkgAAAZU"]
[Sat Nov 22 22:41:07.263786 2025] [:error] [pid 53479:tid 53550] [client 48.210.12.181:11301] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless.php"] [unique_id "aSHLg26cicFF3Aas-oTeNwAAAI4"]
[Sat Nov 22 22:41:07.723461 2025] [:error] [pid 53566:tid 53569] [client 48.210.12.181:11575] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless.php"] [unique_id "aSHLg8bSHDBkRbwMbd5xEwAAAME"]
[Sat Nov 22 22:41:08.284176 2025] [:error] [pid 53478:tid 53526] [client 48.210.12.181:11563] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless.php"] [unique_id "aSHLhAhUYdXBbQswAdQ5IAAAAFE"]
[Sat Nov 22 22:41:09.064213 2025] [:error] [pid 53477:tid 53486] [client 48.210.12.181:11489] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/faq.php"] [unique_id "aSHLhX7Lu30Ku9O40aL_hQAAAAU"]
[Sat Nov 22 22:41:09.811289 2025] [:error] [pid 44259:tid 44273] [client 48.210.12.181:11465] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/faq.php"] [unique_id "aSHLhXXe1xL-_YOdRmTmmgAAAYs"]
[Sat Nov 22 22:41:10.312736 2025] [:error] [pid 44259:tid 44266] [client 48.210.12.181:12252] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/faq.php"] [unique_id "aSHLhnXe1xL-_YOdRmTmnAAAAYQ"]
[Sat Nov 22 22:41:11.215909 2025] [:error] [pid 44259:tid 44276] [client 48.210.12.181:11572] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/faq.php"] [unique_id "aSHLh3Xe1xL-_YOdRmTmngAAAY4"]
[Sat Nov 22 22:41:11.984343 2025] [:error] [pid 53566:tid 53583] [client 48.210.12.181:11314] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "aSHLh8bSHDBkRbwMbd5xFQAAAM8"]
[Sat Nov 22 22:41:12.423858 2025] [:error] [pid 53566:tid 53584] [client 48.210.12.181:11310] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "aSHLiMbSHDBkRbwMbd5xFwAAANA"]
[Sat Nov 22 22:41:12.938651 2025] [:error] [pid 53478:tid 53525] [client 48.210.12.181:11469] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "aSHLiAhUYdXBbQswAdQ5IgAAAFA"]
[Sat Nov 22 22:41:13.466140 2025] [:error] [pid 25856:tid 25873] [client 48.210.12.181:11561] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "aSHLiRsTP0wy94zKUvEDDQAAAQ8"]
[Sat Nov 22 22:41:15.781269 2025] [:error] [pid 9547:tid 9565] [client 48.210.12.181:11533] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/CLA.php"] [unique_id "aSHLi9ClOR5qk7DoMeEOxAAAAUw"]
[Sat Nov 22 22:41:18.925392 2025] [:error] [pid 44259:tid 44283] [client 48.210.12.181:11269] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/CLA.php"] [unique_id "aSHLjnXe1xL-_YOdRmTmrQAAAZU"]
[Sat Nov 22 22:41:19.712450 2025] [:error] [pid 44259:tid 44270] [client 48.210.12.181:11289] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/CLA.php"] [unique_id "aSHLj3Xe1xL-_YOdRmTmrwAAAYg"]
[Sat Nov 22 22:41:20.557783 2025] [:error] [pid 53566:tid 53586] [client 48.210.12.181:11536] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/CLA.php"] [unique_id "aSHLkMbSHDBkRbwMbd5xGAAAANI"]
[Sat Nov 22 22:41:22.387610 2025] [:error] [pid 9547:tid 9562] [client 48.210.12.181:11516] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/chosen.php"] [unique_id "aSHLktClOR5qk7DoMeEOxgAAAUk"]
[Sat Nov 22 22:41:24.914714 2025] [:error] [pid 53478:tid 53522] [client 48.210.12.181:11324] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/chosen.php"] [unique_id "aSHLlAhUYdXBbQswAdQ5KAAAAE0"]
[Sat Nov 22 22:41:26.469234 2025] [:error] [pid 25856:tid 25873] [client 48.210.12.181:11309] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/chosen.php"] [unique_id "aSHLlhsTP0wy94zKUvEDFgAAAQ8"]
[Sat Nov 22 22:41:29.656708 2025] [:error] [pid 53479:tid 53551] [client 48.210.12.181:11490] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/chosen.php"] [unique_id "aSHLmW6cicFF3Aas-oTeQQAAAI8"]
[Sat Nov 22 22:41:30.283138 2025] [:error] [pid 44259:tid 44263] [client 48.210.12.181:11513] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mn.php"] [unique_id "aSHLmnXe1xL-_YOdRmTmxQAAAYE"]
[Sat Nov 22 22:41:32.480245 2025] [:error] [pid 53479:tid 53546] [client 48.210.12.181:11526] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mn.php"] [unique_id "aSHLnG6cicFF3Aas-oTeRQAAAIo"]
[Sat Nov 22 22:41:34.748886 2025] [:error] [pid 44259:tid 44281] [client 48.210.12.181:11265] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mn.php"] [unique_id "aSHLnnXe1xL-_YOdRmTmzAAAAZM"]
[Sat Nov 22 22:41:36.749716 2025] [:error] [pid 53479:tid 53557] [client 48.210.12.181:11464] [client 48.210.12.181] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mn.php"] [unique_id "aSHLoG6cicFF3Aas-oTeRwAAAJU"]
[Sun Nov 23 05:16:39.290777 2025] [:error] [pid 38824:tid 38850] [client 216.126.225.91:37314] [client 216.126.225.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aSIoN08WZjXLvbHTHPfB4AAAANc"]
[Sun Nov 23 07:42:35.726806 2025] [:error] [pid 44652:tid 44720] [client 84.247.191.22:54887] [client 84.247.191.22] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/"] [unique_id "aSJKa9iQFwsyXQDhwyD1xwAAAQ4"], referer: binance.com
[Sun Nov 23 16:39:18.206585 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.50:54605] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aSLINg13QPZSi6O8umWDtQAAAIQ"]
[Sun Nov 23 16:39:18.739705 2025] [:error] [pid 38738:tid 38745] [client 140.99.1.30:49371] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aSLINgytc6TL9XavPmPn4AAAAAM"]
[Sun Nov 23 16:39:19.654414 2025] [:error] [pid 38740:tid 38803] [client 140.99.1.18:40963] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSLINw13QPZSi6O8umWD1wAAAIc"]
[Sun Nov 23 16:39:20.311476 2025] [:error] [pid 14602:tid 14624] [client 140.99.1.76:31515] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aSLIOB-I77jdD81pU-mF6AAAAUM"]
[Sun Nov 23 16:39:21.260652 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.77:35743] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aSLIOdiQFwsyXQDhwyCdsgAAAQk"]
[Sun Nov 23 16:39:21.591206 2025] [:error] [pid 38738:tid 38761] [client 140.99.1.73:36265] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aSLIOQytc6TL9XavPmPoIAAAABM"]
[Sun Nov 23 16:39:22.299961 2025] [:error] [pid 44652:tid 44727] [client 140.99.1.75:39657] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aSLIOtiQFwsyXQDhwyCdyQAAARU"]
[Sun Nov 23 16:39:22.552601 2025] [:error] [pid 44652:tid 44723] [client 140.99.1.20:47563] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aSLIOtiQFwsyXQDhwyCdzAAAARE"]
[Sun Nov 23 16:39:22.795999 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.78:46939] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aSLIOtiQFwsyXQDhwyCdzwAAARA"]
[Sun Nov 23 16:39:23.012443 2025] [:error] [pid 38738:tid 38749] [client 140.99.1.39:64461] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aSLIOwytc6TL9XavPmPoSAAAAAc"]
[Sun Nov 23 16:39:23.437492 2025] [:error] [pid 14602:tid 14637] [client 140.99.1.65:44853] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aSLIOx-I77jdD81pU-mGJAAAAVA"]
[Sun Nov 23 16:39:23.963980 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.11:27331] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "aSLIO9iQFwsyXQDhwyCd6AAAAQc"]
[Sun Nov 23 16:39:24.377526 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.49:52521] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aSLIPNiQFwsyXQDhwyCeAAAAAQo"]
[Sun Nov 23 16:39:24.860212 2025] [:error] [pid 44652:tid 44713] [client 140.99.1.72:56163] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aSLIPNiQFwsyXQDhwyCeCwAAAQc"]
[Sun Nov 23 16:39:25.276909 2025] [:error] [pid 14602:tid 14643] [client 140.99.1.31:30091] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aSLIPR-I77jdD81pU-mGQAAAAVY"]
[Sun Nov 23 16:39:26.680716 2025] [:error] [pid 38738:tid 38751] [client 140.99.1.26:47857] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aSLIPgytc6TL9XavPmPonAAAAAk"]
[Sun Nov 23 16:39:27.039540 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.77:37067] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aSLIPw13QPZSi6O8umWEewAAAIQ"]
[Sun Nov 23 16:39:27.586525 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.32:33409] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aSLIPwytc6TL9XavPmPorAAAABU"]
[Sun Nov 23 16:39:28.003762 2025] [:error] [pid 14602:tid 14624] [client 140.99.1.42:55369] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aSLIQB-I77jdD81pU-mGggAAAUM"]
[Sun Nov 23 16:39:28.669606 2025] [:error] [pid 38739:tid 38778] [client 140.99.1.32:28451] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aSLIQAdvEgJm2n2cDmoYXwAAAEk"]
[Sun Nov 23 16:39:29.046879 2025] [:error] [pid 38824:tid 38835] [client 140.99.1.70:51909] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aSLIQU8WZjXLvbHTHPelAgAAAMg"]
[Sun Nov 23 16:39:29.370774 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.20:44535] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aSLIQQ13QPZSi6O8umWEmAAAAJc"]
[Sun Nov 23 16:39:29.578295 2025] [:error] [pid 38739:tid 38782] [client 140.99.1.30:49085] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aSLIQQdvEgJm2n2cDmoYegAAAE0"]
[Sun Nov 23 16:39:29.829347 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.67:26295] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aSLIQdiQFwsyXQDhwyCeLgAAAQU"]
[Sun Nov 23 16:39:30.808791 2025] [:error] [pid 14602:tid 14630] [client 140.99.1.52:40261] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aSLIQh-I77jdD81pU-mGpAAAAUk"]
[Sun Nov 23 16:39:31.057837 2025] [:error] [pid 14602:tid 14637] [client 140.99.1.37:23269] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aSLIQx-I77jdD81pU-mGrgAAAVA"]
[Sun Nov 23 16:39:31.250968 2025] [:error] [pid 38824:tid 38827] [client 140.99.1.67:38213] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aSLIQ08WZjXLvbHTHPelHgAAAMA"]
[Sun Nov 23 16:39:32.397157 2025] [:error] [pid 38740:tid 38813] [client 140.99.1.33:56843] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aSLIRA13QPZSi6O8umWEygAAAJE"]
[Sun Nov 23 16:39:33.123910 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.11:27149] [client 140.99.1.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.11, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aSLIRU8WZjXLvbHTHPelPgAAANI"]
[Sun Nov 23 16:39:34.488566 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.11:27149] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aSLIRk8WZjXLvbHTHPelUAAAANI"]
[Sun Nov 23 16:39:35.043740 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.47:61081] [client 140.99.1.47] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.47, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aSLIRwytc6TL9XavPmPpQQAAAAY"]
[Sun Nov 23 16:39:35.349655 2025] [:error] [pid 38738:tid 38742] [client 140.99.1.47:61081] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/item.php"] [unique_id "aSLIRwytc6TL9XavPmPpSAAAAAA"]
[Sun Nov 23 16:39:36.611797 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.69:55531] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aSLISE8WZjXLvbHTHPelYgAAANI"]
[Sun Nov 23 16:39:38.969903 2025] [:error] [pid 14602:tid 14640] [client 140.99.1.9:27113] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aSLISh-I77jdD81pU-mHjQAAAVM"]
[Sun Nov 23 16:39:39.419223 2025] [:error] [pid 38824:tid 38850] [client 140.99.1.20:55967] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aSLIS08WZjXLvbHTHPelkgAAANc"]
[Sun Nov 23 16:39:39.816052 2025] [:error] [pid 14602:tid 14644] [client 140.99.1.5:22555] [client 140.99.1.5] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/content.php"] [unique_id "aSLISx-I77jdD81pU-mHpAAAAVc"]
[Sun Nov 23 16:39:40.418946 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.24:31893] [client 140.99.1.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.24, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aSLITA13QPZSi6O8umWFdgAAAIQ"]
[Sun Nov 23 16:39:40.527413 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.24:31893] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aSLITA13QPZSi6O8umWFegAAAJc"]
[Sun Nov 23 16:39:43.665369 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.52:51423] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aSLITwdvEgJm2n2cDmoZlwAAAFM"]
[Sun Nov 23 16:39:44.191477 2025] [:error] [pid 38739:tid 38784] [client 140.99.1.39:59959] [client 140.99.1.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.39, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aSLIUAdvEgJm2n2cDmoZpwAAAE8"]
[Sun Nov 23 16:39:44.758970 2025] [:error] [pid 38739:tid 38785] [client 140.99.1.39:59959] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aSLIUAdvEgJm2n2cDmoZtAAAAFA"]
[Sun Nov 23 16:39:45.040681 2025] [:error] [pid 38824:tid 38850] [client 140.99.1.15:30551] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aSLIUU8WZjXLvbHTHPel6gAAANc"]
[Sun Nov 23 16:39:46.707215 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.71:54753] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aSLIUk8WZjXLvbHTHPemGQAAAMQ"]
[Sun Nov 23 16:39:47.266437 2025] [:error] [pid 14602:tid 14635] [client 140.99.1.53:26285] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aSLIUx-I77jdD81pU-mILgAAAU4"]
[Sun Nov 23 16:39:47.506285 2025] [:error] [pid 38739:tid 38779] [client 140.99.1.38:26037] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aSLIUwdvEgJm2n2cDmoZ4gAAAEo"]
[Sun Nov 23 16:39:48.491880 2025] [:error] [pid 38739:tid 38785] [client 140.99.1.49:46367] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aSLIVAdvEgJm2n2cDmoaAQAAAFA"]
[Sun Nov 23 16:39:48.845420 2025] [:error] [pid 38740:tid 38819] [client 140.99.1.26:51891] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aSLIVA13QPZSi6O8umWGCQAAAJc"]
[Sun Nov 23 16:39:49.413776 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.14:63829] [client 140.99.1.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aSLIVQytc6TL9XavPmPqaAAAAA8"]
[Sun Nov 23 16:39:50.053854 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.7:56889] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aSLIVk8WZjXLvbHTHPemZAAAAM0"]
[Sun Nov 23 16:39:50.504691 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.49:26209] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/click.php"] [unique_id "aSLIVg13QPZSi6O8umWGKgAAAJQ"]
[Sun Nov 23 16:39:51.101680 2025] [:error] [pid 14602:tid 14638] [client 140.99.1.32:22621] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aSLIVx-I77jdD81pU-mIgQAAAVE"]
[Sun Nov 23 16:39:56.316942 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.43:24159] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aSLIXAytc6TL9XavPmPqvwAAABI"]
[Sun Nov 23 16:39:56.549485 2025] [:error] [pid 38739:tid 38776] [client 140.99.1.27:54723] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aSLIXAdvEgJm2n2cDmoajwAAAEc"]
[Sun Nov 23 16:39:56.784108 2025] [:error] [pid 14602:tid 14641] [client 140.99.1.42:65283] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aSLIXB-I77jdD81pU-mJCwAAAVQ"]
[Sun Nov 23 16:39:56.980729 2025] [:error] [pid 14602:tid 14622] [client 140.99.1.77:21283] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aSLIXB-I77jdD81pU-mJDQAAAUE"]
[Sun Nov 23 16:39:57.483858 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.26:65221] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aSLIXQ13QPZSi6O8umWGvAAAAI8"]
[Sun Nov 23 16:39:57.691569 2025] [:error] [pid 44652:tid 44709] [client 140.99.1.32:44107] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSLIXdiQFwsyXQDhwyCfowAAAQM"]
[Sun Nov 23 16:39:58.098592 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.38:33259] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aSLIXk8WZjXLvbHTHPem0QAAANQ"]
[Sun Nov 23 16:39:58.392786 2025] [:error] [pid 38740:tid 38815] [client 140.99.1.37:44531] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSLIXg13QPZSi6O8umWGywAAAJM"]
[Sun Nov 23 16:39:58.583241 2025] [:error] [pid 38739:tid 38773] [client 140.99.1.67:59381] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aSLIXgdvEgJm2n2cDmoauQAAAEQ"]
[Sun Nov 23 16:39:58.884774 2025] [:error] [pid 38740:tid 38812] [client 140.99.1.62:30283] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aSLIXg13QPZSi6O8umWG1gAAAJA"]
[Sun Nov 23 16:39:59.214061 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.53:37917] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aSLIXw13QPZSi6O8umWG3gAAAIs"]
[Sun Nov 23 16:39:59.705290 2025] [:error] [pid 38738:tid 38759] [client 140.99.1.73:58873] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aSLIXwytc6TL9XavPmPq9gAAABE"]
[Sun Nov 23 16:40:04.555438 2025] [:error] [pid 38738:tid 38743] [client 140.99.1.50:57389] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aSLIZAytc6TL9XavPmPrMQAAAAE"]
[Sun Nov 23 16:40:05.918565 2025] [:error] [pid 38824:tid 38827] [client 140.99.1.2:32447] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aSLIZU8WZjXLvbHTHPenRwAAAMA"]
[Sun Nov 23 16:40:06.537217 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.65:22087] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aSLIZk8WZjXLvbHTHPenVwAAAMM"]
[Sun Nov 23 16:40:06.803642 2025] [:error] [pid 44652:tid 44708] [client 140.99.1.16:25503] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aSLIZtiQFwsyXQDhwyCgHQAAAQI"]
[Sun Nov 23 16:40:07.525328 2025] [:error] [pid 38739:tid 38776] [client 140.99.1.74:48777] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aSLIZwdvEgJm2n2cDmobZwAAAEc"]
[Sun Nov 23 16:40:08.103669 2025] [proxy_fcgi:error] [pid 44652:tid 44713] [client 140.99.1.2:46717] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:40:08.236607 2025] [proxy_fcgi:error] [pid 44652:tid 44712] [client 140.99.1.2:46717] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:40:08.379610 2025] [proxy_fcgi:error] [pid 44652:tid 44708] [client 140.99.1.2:46717] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:40:09.258132 2025] [:error] [pid 44652:tid 44712] [client 140.99.1.2:46717] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSLIadiQFwsyXQDhwyCgNQAAAQY"]
[Sun Nov 23 16:40:09.520863 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.33:62113] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aSLIaQytc6TL9XavPmPrZAAAAA4"]
[Sun Nov 23 16:40:09.742837 2025] [:error] [pid 38740:tid 38820] [client 140.99.1.37:56613] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aSLIaQ13QPZSi6O8umWHUgAAAJg"]
[Sun Nov 23 16:40:09.972902 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.76:58243] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aSLIaU8WZjXLvbHTHPenkAAAAM4"]
[Sun Nov 23 16:40:10.271060 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.33:35495] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aSLIagdvEgJm2n2cDmobkQAAAEg"]
[Sun Nov 23 16:40:10.518465 2025] [:error] [pid 44652:tid 44709] [client 140.99.1.30:28873] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "aSLIatiQFwsyXQDhwyCgSgAAAQM"]
[Sun Nov 23 16:40:10.888418 2025] [:error] [pid 38739:tid 38783] [client 140.99.1.75:30651] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "aSLIagdvEgJm2n2cDmobmgAAAE4"]
[Sun Nov 23 16:40:11.087449 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.5:35417] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "aSLIaw13QPZSi6O8umWHcAAAAIM"]
[Sun Nov 23 16:40:11.317917 2025] [:error] [pid 38740:tid 38818] [client 140.99.1.69:32433] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "aSLIaw13QPZSi6O8umWHdAAAAJY"]
[Sun Nov 23 16:40:11.586230 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.72:33293] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "aSLIawytc6TL9XavPmPrlwAAABU"]
[Sun Nov 23 16:40:12.155607 2025] [:error] [pid 38740:tid 38800] [client 140.99.1.46:43467] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "aSLIbA13QPZSi6O8umWHfgAAAIQ"]
[Sun Nov 23 16:40:12.546645 2025] [:error] [pid 14602:tid 14621] [client 140.99.1.53:43343] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSLIbB-I77jdD81pU-mKcgAAAUA"]
[Sun Nov 23 16:40:12.943336 2025] [:error] [pid 44652:tid 44721] [client 140.99.1.63:61387] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "aSLIbNiQFwsyXQDhwyCggAAAAQ8"]
[Sun Nov 23 16:40:13.379829 2025] [:error] [pid 38738:tid 38752] [client 140.99.1.31:26999] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aSLIbQytc6TL9XavPmPruAAAAAo"]
[Sun Nov 23 16:40:14.049288 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.3:39221] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aSLIbg13QPZSi6O8umWHngAAAI0"]
[Sun Nov 23 16:40:14.722877 2025] [:error] [pid 14602:tid 14641] [client 140.99.1.71:30459] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aSLIbh-I77jdD81pU-mKpAAAAVQ"]
[Sun Nov 23 16:40:15.171134 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.6:30465] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "aSLIb08WZjXLvbHTHPenugAAAM0"]
[Sun Nov 23 16:40:17.786014 2025] [:error] [pid 14602:tid 14630] [client 140.99.1.10:44195] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "aSLIcR-I77jdD81pU-mK2gAAAUk"]
[Sun Nov 23 16:40:18.033679 2025] [:error] [pid 38740:tid 38818] [client 140.99.1.33:64053] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aSLIcg13QPZSi6O8umWH5wAAAJY"]
[Sun Nov 23 16:40:18.237003 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.18:56281] [client 140.99.1.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.18, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aSLIck8WZjXLvbHTHPen3QAAAM0"]
[Sun Nov 23 16:40:18.499698 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.18:56281] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "aSLIck8WZjXLvbHTHPen5QAAAMI"]
[Sun Nov 23 16:40:18.884683 2025] [:error] [pid 38824:tid 38842] [client 140.99.1.47:56039] [client 140.99.1.47] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "aSLIck8WZjXLvbHTHPen5wAAAM8"]
[Sun Nov 23 16:40:19.283713 2025] [:error] [pid 38738:tid 38744] [client 140.99.1.2:52557] [client 140.99.1.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "aSLIcwytc6TL9XavPmPsBQAAAAI"]
[Sun Nov 23 16:40:19.555788 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.62:46817] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "aSLIc08WZjXLvbHTHPen6wAAAMI"]
[Sun Nov 23 16:40:20.364031 2025] [:error] [pid 14602:tid 14634] [client 140.99.1.73:62891] [client 140.99.1.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aSLIdB-I77jdD81pU-mLAwAAAU0"]
[Sun Nov 23 16:40:20.627609 2025] [:error] [pid 14602:tid 14622] [client 140.99.1.48:29029] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "aSLIdB-I77jdD81pU-mLBQAAAUE"]
[Sun Nov 23 16:40:21.507710 2025] [:error] [pid 38824:tid 38829] [client 140.99.1.46:64879] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "aSLIdU8WZjXLvbHTHPeoCwAAAMI"]
[Sun Nov 23 16:40:22.057664 2025] [proxy_fcgi:error] [pid 38738:tid 38743] [client 140.99.1.13:42271] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:40:22.255721 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.13:42271] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/function.php"] [unique_id "aSLIdgytc6TL9XavPmPsSQAAABU"]
[Sun Nov 23 16:40:22.598711 2025] [:error] [pid 38738:tid 38745] [client 140.99.1.11:37695] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "aSLIdgytc6TL9XavPmPsTgAAAAM"]
[Sun Nov 23 16:40:23.253634 2025] [:error] [pid 14602:tid 14638] [client 140.99.1.68:23249] [client 140.99.1.68] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "aSLIdx-I77jdD81pU-mLGQAAAVE"]
[Sun Nov 23 16:40:23.437759 2025] [:error] [pid 38824:tid 38831] [client 140.99.1.53:52091] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "aSLId08WZjXLvbHTHPeoHwAAAMQ"]
[Sun Nov 23 16:40:24.618786 2025] [:error] [pid 38738:tid 38756] [client 140.99.1.10:47317] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "aSLIeAytc6TL9XavPmPshQAAAA4"]
[Sun Nov 23 16:40:24.870086 2025] [:error] [pid 14602:tid 14643] [client 140.99.1.20:52829] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "aSLIeB-I77jdD81pU-mLLQAAAVY"]
[Sun Nov 23 16:40:25.615255 2025] [:error] [pid 38739:tid 38780] [client 140.99.1.30:45695] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSLIeQdvEgJm2n2cDmocdQAAAEs"]
[Sun Nov 23 16:40:25.804954 2025] [:error] [pid 14602:tid 14624] [client 140.99.1.71:60645] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aSLIeR-I77jdD81pU-mLQAAAAUM"]
[Sun Nov 23 16:40:25.992619 2025] [:error] [pid 14602:tid 14641] [client 140.99.1.50:39047] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aSLIeR-I77jdD81pU-mLRAAAAVQ"]
[Sun Nov 23 16:40:26.925388 2025] [:error] [pid 38739:tid 38772] [client 140.99.1.24:32269] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "aSLIegdvEgJm2n2cDmociQAAAEM"]
[Sun Nov 23 16:40:27.287603 2025] [:error] [pid 38739:tid 38778] [client 140.99.1.26:50405] [client 140.99.1.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aSLIewdvEgJm2n2cDmocjwAAAEk"]
[Sun Nov 23 16:40:28.669843 2025] [:error] [pid 38824:tid 38844] [client 140.99.1.42:38165] [client 140.99.1.42] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.42, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/js/wp-login.php"] [unique_id "aSLIfE8WZjXLvbHTHPeohwAAANE"]
[Sun Nov 23 16:40:29.647656 2025] [:error] [pid 38824:tid 38848] [client 140.99.1.42:38165] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/bk/index.php"] [unique_id "aSLIfU8WZjXLvbHTHPeonQAAANU"]
[Sun Nov 23 16:40:29.855382 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.49:54975] [client 140.99.1.49] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.49, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "aSLIfQytc6TL9XavPmPtIgAAAA8"]
[Sun Nov 23 16:40:31.332782 2025] [proxy_fcgi:error] [pid 38738:tid 38745] [client 140.99.1.49:54975] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:40:36.518655 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.49:54975] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aSLIhAytc6TL9XavPmPtlgAAABg"]
[Sun Nov 23 16:40:37.078774 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.28:65315] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aSLIhU8WZjXLvbHTHPepGgAAAM4"]
[Sun Nov 23 16:40:37.718424 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.16:64203] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "aSLIhQdvEgJm2n2cDmodPQAAAFg"]
[Sun Nov 23 16:40:39.155346 2025] [:error] [pid 14602:tid 14624] [client 140.99.1.43:56207] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "aSLIhx-I77jdD81pU-mMZAAAAUM"]
[Sun Nov 23 16:40:39.650364 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.47:60277] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aSLIhwdvEgJm2n2cDmodZwAAAEg"]
[Sun Nov 23 16:40:40.659011 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.53:41569] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aSLIiE8WZjXLvbHTHPepTAAAAMY"]
[Sun Nov 23 16:40:41.394625 2025] [proxy_fcgi:error] [pid 38738:tid 38763] [client 140.99.1.50:27005] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:40:41.535601 2025] [proxy_fcgi:error] [pid 38738:tid 38748] [client 140.99.1.50:27005] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:40:41.641990 2025] [:error] [pid 38738:tid 38759] [client 140.99.1.50:27005] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "aSLIiQytc6TL9XavPmPt-gAAABE"]
[Sun Nov 23 16:40:41.888661 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.6:55897] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "aSLIiU8WZjXLvbHTHPepXQAAANA"]
[Sun Nov 23 16:40:43.607649 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.32:33131] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "aSLIiwdvEgJm2n2cDmodoQAAAFY"]
[Sun Nov 23 16:40:43.951637 2025] [:error] [pid 38739:tid 38773] [client 140.99.1.47:58595] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "aSLIiwdvEgJm2n2cDmodqAAAAEQ"]
[Sun Nov 23 16:40:44.638946 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.50:30079] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aSLIjAytc6TL9XavPmPuHQAAAAY"]
[Sun Nov 23 16:40:46.126047 2025] [:error] [pid 38740:tid 38817] [client 140.99.1.65:56213] [client 140.99.1.65] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "aSLIjg13QPZSi6O8umWKBAAAAJU"]
[Sun Nov 23 16:40:46.448623 2025] [proxy_fcgi:error] [pid 38738:tid 38757] [client 140.99.1.52:34103] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:40:46.830655 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.52:34103] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "aSLIjgytc6TL9XavPmPuSAAAAA8"]
[Sun Nov 23 16:40:47.906621 2025] [proxy_fcgi:error] [pid 38740:tid 38808] [client 140.99.1.72:58621] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:40:48.142376 2025] [:error] [pid 38740:tid 38801] [client 140.99.1.72:58621] [client 140.99.1.72] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.72, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "aSLIkA13QPZSi6O8umWKMQAAAIU"]
[Sun Nov 23 16:40:51.726601 2025] [:error] [pid 38740:tid 38799] [client 140.99.1.72:58621] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "aSLIkw13QPZSi6O8umWKagAAAIM"]
[Sun Nov 23 16:40:52.139509 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.77:37533] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "aSLIlAytc6TL9XavPmPu1wAAABU"]
[Sun Nov 23 16:40:52.785775 2025] [:error] [pid 38740:tid 38796] [client 140.99.1.30:32275] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "aSLIlA13QPZSi6O8umWKiwAAAIA"]
[Sun Nov 23 16:40:54.475259 2025] [:error] [pid 14602:tid 14631] [client 140.99.1.69:63327] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "aSLIlh-I77jdD81pU-mNtQAAAUo"]
[Sun Nov 23 16:40:54.882717 2025] [:error] [pid 38824:tid 38846] [client 140.99.1.20:42313] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "aSLIlk8WZjXLvbHTHPeqXgAAANM"]
[Sun Nov 23 16:40:55.602933 2025] [:error] [pid 14602:tid 14623] [client 140.99.1.28:28645] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "aSLIlx-I77jdD81pU-mN0gAAAUI"]
[Sun Nov 23 16:40:56.051958 2025] [:error] [pid 38738:tid 38749] [client 140.99.1.50:64793] [client 140.99.1.50] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/classwithtostring.php"] [unique_id "aSLImAytc6TL9XavPmPvRQAAAAc"]
[Sun Nov 23 16:40:56.412011 2025] [proxy_fcgi:error] [pid 38739:tid 38775] [client 140.99.1.20:33123] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:40:56.508027 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.20:33123] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "aSLImAdvEgJm2n2cDmoeXgAAAFg"]
[Sun Nov 23 16:40:56.997496 2025] [:error] [pid 14602:tid 14627] [client 140.99.1.8:27207] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/db.php"] [unique_id "aSLImB-I77jdD81pU-mN-gAAAUY"]
[Sun Nov 23 16:40:57.207832 2025] [:error] [pid 38739:tid 38788] [client 140.99.1.78:30641] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "aSLImQdvEgJm2n2cDmoeagAAAFM"]
[Sun Nov 23 16:40:57.424671 2025] [:error] [pid 38824:tid 38849] [client 140.99.1.30:37279] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aSLImU8WZjXLvbHTHPeqhAAAANY"]
[Sun Nov 23 16:40:57.713852 2025] [:error] [pid 14602:tid 14630] [client 140.99.1.20:37351] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "aSLImR-I77jdD81pU-mOCQAAAUk"]
[Sun Nov 23 16:41:01.368379 2025] [:error] [pid 14602:tid 14627] [client 140.99.1.47:29513] [client 140.99.1.47] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "aSLInR-I77jdD81pU-mOZQAAAUY"]
[Sun Nov 23 16:41:01.557818 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.46:64639] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "aSLInU8WZjXLvbHTHPequAAAAM0"]
[Sun Nov 23 16:41:01.952113 2025] [:error] [pid 14602:tid 14636] [client 140.99.1.49:36531] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "aSLInR-I77jdD81pU-mOgAAAAU8"]
[Sun Nov 23 16:41:02.227764 2025] [:error] [pid 38824:tid 38850] [client 140.99.1.10:63459] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "aSLInk8WZjXLvbHTHPeq3gAAANc"]
[Sun Nov 23 16:41:02.563561 2025] [:error] [pid 38739:tid 38770] [client 140.99.1.5:26781] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "aSLIngdvEgJm2n2cDmoe6wAAAEE"]
[Sun Nov 23 16:41:02.914613 2025] [:error] [pid 38740:tid 38806] [client 140.99.1.75:21295] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "aSLIng13QPZSi6O8umWLawAAAIo"]
[Sun Nov 23 16:41:03.503251 2025] [:error] [pid 44652:tid 44720] [client 140.99.1.28:28491] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "aSLIn9iQFwsyXQDhwyCj3gAAAQ4"]
[Sun Nov 23 16:41:03.744741 2025] [proxy_fcgi:error] [pid 44652:tid 44721] [client 140.99.1.5:53565] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:41:04.207267 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.5:53565] [client 140.99.1.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.5, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "aSLIoNiQFwsyXQDhwyCkBgAAAQU"]
[Sun Nov 23 16:41:04.893419 2025] [:error] [pid 44652:tid 44715] [client 140.99.1.5:53565] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/feed-rsss.php"] [unique_id "aSLIoNiQFwsyXQDhwyCkGwAAAQk"]
[Sun Nov 23 16:41:05.101956 2025] [:error] [pid 38740:tid 38805] [client 140.99.1.15:37485] [client 140.99.1.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "aSLIoQ13QPZSi6O8umWLsQAAAIk"]
[Sun Nov 23 16:41:11.559428 2025] [:error] [pid 38824:tid 38841] [client 140.99.1.71:57971] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSLIp08WZjXLvbHTHPeruAAAAM4"]
[Sun Nov 23 16:41:11.834651 2025] [:error] [pid 14602:tid 14641] [client 140.99.1.37:25425] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "aSLIpx-I77jdD81pU-mPJQAAAVQ"]
[Sun Nov 23 16:41:12.018806 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.5:26129] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aSLIqE8WZjXLvbHTHPeruwAAAM0"]
[Sun Nov 23 16:41:13.228301 2025] [:error] [pid 44652:tid 44717] [client 140.99.1.8:27151] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "aSLIqdiQFwsyXQDhwyCktgAAAQs"]
[Sun Nov 23 16:41:13.553496 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.38:49065] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "aSLIqU8WZjXLvbHTHPeryAAAAMY"]
[Sun Nov 23 16:41:13.813758 2025] [:error] [pid 38824:tid 38827] [client 140.99.1.16:28901] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "aSLIqU8WZjXLvbHTHPer0QAAAMA"]
[Sun Nov 23 16:41:14.735673 2025] [:error] [pid 44652:tid 44706] [client 140.99.1.75:58799] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "aSLIqtiQFwsyXQDhwyCk4AAAAQA"]
[Sun Nov 23 16:41:15.038506 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.31:50499] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "aSLIqw13QPZSi6O8umWMigAAAIw"]
[Sun Nov 23 16:41:15.553602 2025] [:error] [pid 38824:tid 38850] [client 140.99.1.49:25653] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "aSLIq08WZjXLvbHTHPer8QAAANc"]
[Sun Nov 23 16:41:21.387276 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.78:26495] [client 140.99.1.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aSLIsQytc6TL9XavPmPxLgAAABI"]
[Sun Nov 23 16:41:22.417104 2025] [:error] [pid 38738:tid 38748] [client 140.99.1.70:40021] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/about.php"] [unique_id "aSLIsgytc6TL9XavPmPxUQAAAAY"]
[Sun Nov 23 16:41:23.383315 2025] [:error] [pid 38739:tid 38789] [client 140.99.1.46:22013] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "aSLIswdvEgJm2n2cDmohDgAAAFQ"]
[Sun Nov 23 16:41:23.982014 2025] [:error] [pid 38740:tid 38818] [client 140.99.1.3:49437] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "aSLIsw13QPZSi6O8umWNMwAAAJY"]
[Sun Nov 23 16:41:25.087672 2025] [:error] [pid 14602:tid 14642] [client 140.99.1.27:50621] [client 140.99.1.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "aSLItR-I77jdD81pU-mQOgAAAVU"]
[Sun Nov 23 16:41:26.388607 2025] [:error] [pid 14602:tid 14645] [client 140.99.1.33:58011] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "aSLIth-I77jdD81pU-mQbwAAAVg"]
[Sun Nov 23 16:41:27.049837 2025] [:error] [pid 38740:tid 38798] [client 140.99.1.77:36149] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "aSLItw13QPZSi6O8umWNbQAAAII"]
[Sun Nov 23 16:41:27.528515 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.33:63553] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "aSLIt08WZjXLvbHTHPes8AAAAME"]
[Sun Nov 23 16:41:28.490204 2025] [:error] [pid 38824:tid 38850] [client 140.99.1.53:50079] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "aSLIuE8WZjXLvbHTHPetDwAAANc"]
[Sun Nov 23 16:41:29.449907 2025] [:error] [pid 14602:tid 14635] [client 140.99.1.17:64993] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "aSLIuR-I77jdD81pU-mQ0wAAAU4"]
[Sun Nov 23 16:41:31.448365 2025] [:error] [pid 38739:tid 38782] [client 140.99.1.43:59519] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSLIuwdvEgJm2n2cDmohswAAAE0"]
[Sun Nov 23 16:41:31.853707 2025] [:error] [pid 16066:tid 16091] [client 140.99.1.42:43297] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "aSLIu_q-c47Q5mW5E9FhewAAAZY"]
[Sun Nov 23 16:41:32.349448 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.77:46183] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "aSLIvAytc6TL9XavPmPyMQAAABc"]
[Sun Nov 23 16:41:33.012490 2025] [:error] [pid 38738:tid 38745] [client 140.99.1.74:27465] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "aSLIvQytc6TL9XavPmPyTwAAAAM"]
[Sun Nov 23 16:41:33.302201 2025] [:error] [pid 16066:tid 16085] [client 140.99.1.18:57221] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "aSLIvfq-c47Q5mW5E9FhlQAAAZA"]
[Sun Nov 23 16:41:34.463494 2025] [:error] [pid 16066:tid 16092] [client 140.99.1.67:54285] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "aSLIvvq-c47Q5mW5E9FhsgAAAZc"]
[Sun Nov 23 16:41:34.950988 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.39:48885] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "aSLIvgytc6TL9XavPmPyfgAAABU"]
[Sun Nov 23 16:41:35.322790 2025] [:error] [pid 38739:tid 38791] [client 140.99.1.6:37521] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "aSLIvwdvEgJm2n2cDmoh7wAAAFY"]
[Sun Nov 23 16:41:35.846677 2025] [:error] [pid 38824:tid 38827] [client 140.99.1.20:22905] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "aSLIv08WZjXLvbHTHPetuQAAAMA"]
[Sun Nov 23 16:41:36.863446 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.39:46431] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "aSLIwE8WZjXLvbHTHPet0QAAAMM"]
[Sun Nov 23 16:41:37.834862 2025] [:error] [pid 14602:tid 14641] [client 140.99.1.8:35897] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "aSLIwR-I77jdD81pU-mRYQAAAVQ"]
[Sun Nov 23 16:41:38.487630 2025] [:error] [pid 44652:tid 44720] [client 140.99.1.18:47645] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "aSLIwtiQFwsyXQDhwyCnXwAAAQ4"]
[Sun Nov 23 16:41:38.968465 2025] [:error] [pid 38738:tid 38762] [client 140.99.1.31:28961] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "aSLIwgytc6TL9XavPmPy4gAAABQ"]
[Sun Nov 23 16:41:39.292832 2025] [:error] [pid 38824:tid 38837] [client 140.99.1.17:48695] [client 140.99.1.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/as.php"] [unique_id "aSLIw08WZjXLvbHTHPet_QAAAMo"]
[Sun Nov 23 16:41:39.714722 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.74:29151] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "aSLIwwytc6TL9XavPmPy8gAAABg"]
[Sun Nov 23 16:41:47.173628 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.37:56667] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/install.php"] [unique_id "aSLIy08WZjXLvbHTHPeumgAAANA"]
[Sun Nov 23 16:41:47.397023 2025] [:error] [pid 14602:tid 14645] [client 140.99.1.72:49907] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "aSLIyx-I77jdD81pU-mSBAAAAVg"]
[Sun Nov 23 16:41:48.612367 2025] [:error] [pid 14602:tid 14637] [client 140.99.1.8:43645] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "aSLIzB-I77jdD81pU-mSJAAAAVA"]
[Sun Nov 23 16:41:49.398604 2025] [:error] [pid 38824:tid 38836] [client 140.99.1.49:53715] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aSLIzU8WZjXLvbHTHPeu0wAAAMk"]
[Sun Nov 23 16:41:50.440985 2025] [:error] [pid 16066:tid 16081] [client 140.99.1.9:58745] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "aSLIzvq-c47Q5mW5E9FjIgAAAYw"]
[Sun Nov 23 16:41:51.388585 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.74:46279] [client 140.99.1.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "aSLIzwytc6TL9XavPmPz1gAAABc"]
[Sun Nov 23 16:41:52.415718 2025] [:error] [pid 38740:tid 38797] [client 140.99.1.42:62169] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "aSLI0A13QPZSi6O8umWPmAAAAIE"]
[Sun Nov 23 16:41:52.935446 2025] [:error] [pid 14602:tid 14638] [client 140.99.1.10:59101] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "aSLI0B-I77jdD81pU-mSggAAAVE"]
[Sun Nov 23 16:41:53.493123 2025] [:error] [pid 14602:tid 14628] [client 140.99.1.44:49549] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "aSLI0R-I77jdD81pU-mSkwAAAUc"]
[Sun Nov 23 16:41:54.000255 2025] [:error] [pid 16066:tid 16086] [client 140.99.1.18:53425] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "aSLI0fq-c47Q5mW5E9FjjQAAAZE"]
[Sun Nov 23 16:41:55.685885 2025] [:error] [pid 38738:tid 38758] [client 140.99.1.39:41467] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "aSLI0wytc6TL9XavPmP0MAAAABA"]
[Sun Nov 23 16:41:55.915935 2025] [:error] [pid 14602:tid 14626] [client 140.99.1.72:38951] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "aSLI0x-I77jdD81pU-mStwAAAUU"]
[Sun Nov 23 16:41:56.182018 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.43:30417] [client 140.99.1.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php%20"] [unique_id "aSLI1A13QPZSi6O8umWQLwAAAI8"]
[Sun Nov 23 16:41:57.203139 2025] [:error] [pid 38739:tid 38786] [client 140.99.1.49:58205] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "aSLI1QdvEgJm2n2cDmojoQAAAFE"]
[Sun Nov 23 16:41:57.392445 2025] [:error] [pid 44652:tid 44717] [client 140.99.1.76:20341] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "aSLI1diQFwsyXQDhwyCofwAAAQs"]
[Sun Nov 23 16:41:57.925981 2025] [:error] [pid 44652:tid 44724] [client 140.99.1.30:41319] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "aSLI1diQFwsyXQDhwyComQAAARI"]
[Sun Nov 23 16:41:58.129326 2025] [:error] [pid 16066:tid 16088] [client 140.99.1.52:63383] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "aSLI1vq-c47Q5mW5E9Fj9QAAAZM"]
[Sun Nov 23 16:41:58.369791 2025] [:error] [pid 14602:tid 14625] [client 140.99.1.24:61285] [client 140.99.1.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.24, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "aSLI1h-I77jdD81pU-mS4wAAAUQ"]
[Sun Nov 23 16:41:58.405658 2025] [proxy_fcgi:error] [pid 14602:tid 14625] [client 140.99.1.24:61285] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:41:58.539197 2025] [:error] [pid 14602:tid 14636] [client 140.99.1.24:61285] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "aSLI1h-I77jdD81pU-mS6QAAAU8"]
[Sun Nov 23 16:42:04.552581 2025] [:error] [pid 38738:tid 38763] [client 140.99.1.6:34765] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aSLI3Aytc6TL9XavPmP04AAAABU"]
[Sun Nov 23 16:42:04.788307 2025] [:error] [pid 38738:tid 38765] [client 140.99.1.28:24473] [client 140.99.1.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/network.php"] [unique_id "aSLI3Aytc6TL9XavPmP05QAAABc"]
[Sun Nov 23 16:42:06.375160 2025] [:error] [pid 38738:tid 38750] [client 140.99.1.48:60855] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "aSLI3gytc6TL9XavPmP1CgAAAAg"]
[Sun Nov 23 16:42:06.571703 2025] [:error] [pid 14602:tid 14627] [client 140.99.1.7:64353] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "aSLI3h-I77jdD81pU-mTlgAAAUY"]
[Sun Nov 23 16:42:07.966835 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.75:25019] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "aSLI308WZjXLvbHTHPewVAAAAM0"]
[Sun Nov 23 16:42:08.167365 2025] [:error] [pid 16066:tid 16070] [client 140.99.1.44:34041] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "aSLI4Pq-c47Q5mW5E9FlIAAAAYE"]
[Sun Nov 23 16:42:08.437151 2025] [proxy_fcgi:error] [pid 38740:tid 38798] [client 140.99.1.8:26557] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:42:08.531502 2025] [:error] [pid 38740:tid 38818] [client 140.99.1.8:26557] [client 140.99.1.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 140.99.1.8, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aSLI4A13QPZSi6O8umWRZgAAAJY"]
[Sun Nov 23 16:42:08.779220 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.8:26557] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "aSLI4A13QPZSi6O8umWRcAAAAI8"]
[Sun Nov 23 16:42:09.640261 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.7:32297] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "aSLI4diQFwsyXQDhwyCpeQAAARc"]
[Sun Nov 23 16:42:10.052833 2025] [:error] [pid 16066:tid 16075] [client 140.99.1.38:53477] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "aSLI4vq-c47Q5mW5E9FlVgAAAYY"]
[Sun Nov 23 16:42:10.322938 2025] [:error] [pid 38739:tid 38793] [client 140.99.1.37:52301] [client 140.99.1.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "aSLI4gdvEgJm2n2cDmolDAAAAFg"]
[Sun Nov 23 16:42:12.211400 2025] [:error] [pid 14602:tid 14642] [client 140.99.1.16:37469] [client 140.99.1.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "aSLI5B-I77jdD81pU-mUGQAAAVU"]
[Sun Nov 23 16:42:12.797528 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.71:27229] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aSLI5Aytc6TL9XavPmP1_AAAAA8"]
[Sun Nov 23 16:42:13.718111 2025] [:error] [pid 16066:tid 16078] [client 140.99.1.63:33975] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "aSLI5fq-c47Q5mW5E9FlsgAAAYk"]
[Sun Nov 23 16:42:15.864755 2025] [:error] [pid 44652:tid 44726] [client 140.99.1.43:23707] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "aSLI59iQFwsyXQDhwyCpywAAARQ"]
[Sun Nov 23 16:42:16.307651 2025] [:error] [pid 44652:tid 44707] [client 140.99.1.30:56093] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/count.php"] [unique_id "aSLI6NiQFwsyXQDhwyCp0AAAAQE"]
[Sun Nov 23 16:42:18.298255 2025] [:error] [pid 16066:tid 16090] [client 140.99.1.30:48389] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aSLI6vq-c47Q5mW5E9FmHQAAAZU"]
[Sun Nov 23 16:42:19.042832 2025] [:error] [pid 16066:tid 16075] [client 140.99.1.33:45473] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "paramountestate.com.au"] [uri "/images/stories/themes.php"] [unique_id "aSLI6_q-c47Q5mW5E9FmJgAAAYY"]
[Sun Nov 23 16:42:19.178257 2025] [:error] [pid 16066:tid 16072] [client 140.99.1.33:45473] [client 140.99.1.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "aSLI6_q-c47Q5mW5E9FmKwAAAYM"]
[Sun Nov 23 16:42:19.875358 2025] [:error] [pid 38824:tid 38845] [client 140.99.1.31:32207] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "aSLI608WZjXLvbHTHPexBAAAANI"]
[Sun Nov 23 16:42:21.139932 2025] [:error] [pid 16066:tid 16089] [client 140.99.1.38:62539] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "aSLI7fq-c47Q5mW5E9FmTwAAAZQ"]
[Sun Nov 23 16:42:22.790880 2025] [:error] [pid 44652:tid 44728] [client 140.99.1.43:26933] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "aSLI7tiQFwsyXQDhwyCqcwAAARY"]
[Sun Nov 23 16:42:23.249248 2025] [:error] [pid 14602:tid 14644] [client 140.99.1.32:63093] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "aSLI7x-I77jdD81pU-mVHwAAAVc"]
[Sun Nov 23 16:42:24.124173 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.6:29523] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "aSLI8NiQFwsyXQDhwyCqkQAAAQg"]
[Sun Nov 23 16:42:25.395411 2025] [:error] [pid 16066:tid 16073] [client 140.99.1.52:40311] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "aSLI8fq-c47Q5mW5E9FmoAAAAYQ"]
[Sun Nov 23 16:42:25.745884 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.48:30687] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/colour.php"] [unique_id "aSLI8U8WZjXLvbHTHPexUQAAANA"]
[Sun Nov 23 16:42:26.355398 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.3:25111] [client 140.99.1.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "aSLI8k8WZjXLvbHTHPexWgAAANA"]
[Sun Nov 23 16:42:26.540780 2025] [:error] [pid 38738:tid 38766] [client 140.99.1.10:46641] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "aSLI8gytc6TL9XavPmP33gAAABg"]
[Sun Nov 23 16:42:27.043448 2025] [:error] [pid 38824:tid 38843] [client 140.99.1.71:53751] [client 140.99.1.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "aSLI808WZjXLvbHTHPexZwAAANA"]
[Sun Nov 23 16:42:28.199593 2025] [:error] [pid 38739:tid 38787] [client 140.99.1.52:40023] [client 140.99.1.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "aSLI9AdvEgJm2n2cDmomMgAAAFI"]
[Sun Nov 23 16:42:28.459213 2025] [:error] [pid 16066:tid 16083] [client 140.99.1.63:31929] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "aSLI9Pq-c47Q5mW5E9Fm6gAAAY4"]
[Sun Nov 23 16:42:29.369426 2025] [:error] [pid 38738:tid 38757] [client 140.99.1.42:45219] [client 140.99.1.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "aSLI9Qytc6TL9XavPmP4QQAAAA8"]
[Sun Nov 23 16:42:29.969006 2025] [:error] [pid 38739:tid 38792] [client 140.99.1.5:63419] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "aSLI9QdvEgJm2n2cDmomaQAAAFc"]
[Sun Nov 23 16:42:30.754264 2025] [:error] [pid 16066:tid 16093] [client 140.99.1.48:36015] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "aSLI9vq-c47Q5mW5E9FnOQAAAZg"]
[Sun Nov 23 16:42:31.008044 2025] [:error] [pid 38740:tid 38807] [client 140.99.1.9:46477] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "aSLI9g13QPZSi6O8umWTUwAAAIs"]
[Sun Nov 23 16:42:31.455365 2025] [:error] [pid 38740:tid 38808] [client 140.99.1.5:59497] [client 140.99.1.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "aSLI9w13QPZSi6O8umWTYgAAAIw"]
[Sun Nov 23 16:42:32.067018 2025] [:error] [pid 38824:tid 38842] [client 140.99.1.44:37319] [client 140.99.1.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "aSLI-E8WZjXLvbHTHPexuAAAAM8"]
[Sun Nov 23 16:42:32.633264 2025] [:error] [pid 14602:tid 14625] [client 140.99.1.13:51267] [client 140.99.1.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "aSLI-B-I77jdD81pU-mWJwAAAUQ"]
[Sun Nov 23 16:42:32.938893 2025] [:error] [pid 14602:tid 14622] [client 140.99.1.48:42781] [client 140.99.1.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "aSLI-B-I77jdD81pU-mWMgAAAUE"]
[Sun Nov 23 16:42:33.341834 2025] [:error] [pid 44652:tid 44725] [client 140.99.1.53:45699] [client 140.99.1.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aSLI-diQFwsyXQDhwyCrnQAAARM"]
[Sun Nov 23 16:42:33.567558 2025] [:error] [pid 38739:tid 38778] [client 140.99.1.9:57607] [client 140.99.1.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "aSLI-QdvEgJm2n2cDmomxQAAAEk"]
[Sun Nov 23 16:42:34.675847 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.39:56773] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "aSLI-gytc6TL9XavPmP5AAAAABI"]
[Sun Nov 23 16:42:35.078152 2025] [:error] [pid 16066:tid 16087] [client 140.99.1.38:47531] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "aSLI-_q-c47Q5mW5E9FnuwAAAZI"]
[Sun Nov 23 16:42:35.278013 2025] [:error] [pid 38740:tid 38818] [client 140.99.1.31:32931] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "aSLI-w13QPZSi6O8umWTtQAAAJY"]
[Sun Nov 23 16:42:35.673845 2025] [:error] [pid 38739:tid 38778] [client 140.99.1.6:47721] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "aSLI-wdvEgJm2n2cDmom7gAAAEk"]
[Sun Nov 23 16:42:36.316327 2025] [:error] [pid 44652:tid 44719] [client 140.99.1.20:45731] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "aSLI_NiQFwsyXQDhwyCr_gAAAQ0"]
[Sun Nov 23 16:42:36.876889 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.70:31679] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "aSLI_AdvEgJm2n2cDmonBAAAAEg"]
[Sun Nov 23 16:42:37.661384 2025] [:error] [pid 38824:tid 38830] [client 140.99.1.7:38903] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "aSLI_U8WZjXLvbHTHPeyGgAAAMM"]
[Sun Nov 23 16:42:38.030679 2025] [:error] [pid 16066:tid 16090] [client 140.99.1.46:25429] [client 140.99.1.46] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "aSLI_vq-c47Q5mW5E9Fn_AAAAZU"]
[Sun Nov 23 16:42:39.045008 2025] [:error] [pid 14602:tid 14631] [client 140.99.1.77:35503] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "aSLI_x-I77jdD81pU-mWswAAAUo"]
[Sun Nov 23 16:42:39.317108 2025] [:error] [pid 38824:tid 38833] [client 140.99.1.8:45007] [client 140.99.1.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "aSLI_08WZjXLvbHTHPeyQgAAAMY"]
[Sun Nov 23 16:42:39.984687 2025] [:error] [pid 16066:tid 16088] [client 140.99.1.76:22557] [client 140.99.1.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "aSLI__q-c47Q5mW5E9FoGgAAAZM"]
[Sun Nov 23 16:42:40.975178 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.6:36607] [client 140.99.1.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "aSLJAA13QPZSi6O8umWUZgAAAI8"]
[Sun Nov 23 16:42:41.523557 2025] [:error] [pid 44652:tid 44706] [client 140.99.1.50:62941] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "aSLJAdiQFwsyXQDhwyCsgAAAAQA"]
[Sun Nov 23 16:42:42.176756 2025] [:error] [pid 38740:tid 38811] [client 140.99.1.38:65285] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "aSLJAg13QPZSi6O8umWUkQAAAI8"]
[Sun Nov 23 16:42:42.486925 2025] [:error] [pid 38824:tid 38847] [client 140.99.1.50:52821] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "aSLJAk8WZjXLvbHTHPeykQAAANQ"]
[Sun Nov 23 16:42:43.412166 2025] [:error] [pid 14602:tid 14629] [client 140.99.1.11:27121] [client 140.99.1.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "aSLJAx-I77jdD81pU-mW8gAAAUg"]
[Sun Nov 23 16:42:44.399986 2025] [:error] [pid 38739:tid 38777] [client 140.99.1.10:20043] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aSLJBAdvEgJm2n2cDmontAAAAEg"]
[Sun Nov 23 16:42:45.555006 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.32:37973] [client 140.99.1.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "aSLJBdiQFwsyXQDhwyCsygAAARA"]
[Sun Nov 23 16:42:45.896700 2025] [proxy_fcgi:error] [pid 14602:tid 14641] [client 140.99.1.62:54859] AH01071: Got error 'Primary script unknown'
[Sun Nov 23 16:42:46.114094 2025] [:error] [pid 14602:tid 14622] [client 140.99.1.62:54859] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "aSLJBh-I77jdD81pU-mXEAAAAUE"]
[Sun Nov 23 16:42:46.361056 2025] [:error] [pid 44652:tid 44714] [client 140.99.1.50:39661] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "aSLJBtiQFwsyXQDhwyCs3QAAAQg"]
[Sun Nov 23 16:42:47.004118 2025] [:error] [pid 16066:tid 16083] [client 140.99.1.77:55649] [client 140.99.1.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "aSLJBvq-c47Q5mW5E9FojAAAAY4"]
[Sun Nov 23 16:42:47.413451 2025] [:error] [pid 38739:tid 38775] [client 140.99.1.24:37163] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "aSLJBwdvEgJm2n2cDmon8wAAAEY"]
[Sun Nov 23 16:42:51.783176 2025] [:error] [pid 38740:tid 38810] [client 140.99.1.72:42673] [client 140.99.1.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "aSLJCw13QPZSi6O8umWV0gAAAI4"]
[Sun Nov 23 16:42:52.109905 2025] [:error] [pid 44652:tid 44722] [client 140.99.1.30:24673] [client 140.99.1.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "aSLJDNiQFwsyXQDhwyCtKQAAARA"]
[Sun Nov 23 16:42:52.480893 2025] [:error] [pid 38824:tid 38828] [client 140.99.1.63:61327] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/log.php"] [unique_id "aSLJDE8WZjXLvbHTHPezZgAAAME"]
[Sun Nov 23 16:42:53.248198 2025] [:error] [pid 44652:tid 44716] [client 140.99.1.31:55297] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "aSLJDdiQFwsyXQDhwyCtNgAAAQo"]
[Sun Nov 23 16:42:53.493923 2025] [:error] [pid 38740:tid 38816] [client 140.99.1.43:61073] [client 140.99.1.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "aSLJDQ13QPZSi6O8umWV7QAAAJQ"]
[Sun Nov 23 16:42:53.726737 2025] [:error] [pid 14602:tid 14633] [client 140.99.1.49:50961] [client 140.99.1.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/aw.php"] [unique_id "aSLJDR-I77jdD81pU-mXcAAAAUw"]
[Sun Nov 23 16:42:55.083170 2025] [:error] [pid 16066:tid 16071] [client 140.99.1.24:21019] [client 140.99.1.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "aSLJD_q-c47Q5mW5E9FpNAAAAYI"]
[Sun Nov 23 16:42:55.336661 2025] [:error] [pid 44652:tid 44706] [client 140.99.1.38:57153] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "aSLJD9iQFwsyXQDhwyCtXQAAAQA"]
[Sun Nov 23 16:42:56.783758 2025] [:error] [pid 38739:tid 38771] [client 140.99.1.10:51793] [client 140.99.1.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "aSLJEAdvEgJm2n2cDmoozQAAAEI"]
[Sun Nov 23 16:42:56.967871 2025] [:error] [pid 44652:tid 44729] [client 140.99.1.20:61595] [client 140.99.1.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "aSLJENiQFwsyXQDhwyCtbAAAARc"]
[Sun Nov 23 16:42:57.558023 2025] [:error] [pid 44652:tid 44710] [client 140.99.1.69:26491] [client 140.99.1.69] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "aSLJEdiQFwsyXQDhwyCtdQAAAQQ"]
[Sun Nov 23 16:42:57.755405 2025] [:error] [pid 14602:tid 14621] [client 140.99.1.67:29705] [client 140.99.1.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "aSLJER-I77jdD81pU-mXjwAAAUA"]
[Sun Nov 23 16:42:59.398632 2025] [:error] [pid 14602:tid 14643] [client 140.99.1.38:47411] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "aSLJEx-I77jdD81pU-mXtwAAAVY"]
[Sun Nov 23 16:42:59.648069 2025] [:error] [pid 16066:tid 16079] [client 140.99.1.75:28817] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "aSLJE_q-c47Q5mW5E9FpcAAAAYo"]
[Sun Nov 23 16:43:00.240374 2025] [:error] [pid 14602:tid 14636] [client 140.99.1.7:57335] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/file.php"] [unique_id "aSLJFB-I77jdD81pU-mXxQAAAU8"]
[Sun Nov 23 16:43:00.610689 2025] [:error] [pid 38824:tid 38840] [client 140.99.1.38:61259] [client 140.99.1.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aSLJFE8WZjXLvbHTHPe0DwAAAM0"]
[Sun Nov 23 16:43:01.336600 2025] [:error] [pid 44652:tid 44711] [client 140.99.1.62:44451] [client 140.99.1.62] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/load.php"] [unique_id "aSLJFdiQFwsyXQDhwyCtlgAAAQU"]
[Sun Nov 23 16:43:01.556945 2025] [:error] [pid 38740:tid 38802] [client 140.99.1.7:40701] [client 140.99.1.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "aSLJFQ13QPZSi6O8umWWmwAAAIY"]
[Sun Nov 23 16:43:01.783014 2025] [:error] [pid 38740:tid 38803] [client 140.99.1.18:29501] [client 140.99.1.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "aSLJFQ13QPZSi6O8umWWoAAAAIc"]
[Sun Nov 23 16:43:02.479593 2025] [:error] [pid 16066:tid 16085] [client 140.99.1.39:54325] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "aSLJFvq-c47Q5mW5E9FpmQAAAZA"]
[Sun Nov 23 16:43:02.802649 2025] [:error] [pid 38740:tid 38809] [client 140.99.1.75:33965] [client 140.99.1.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "aSLJFg13QPZSi6O8umWWwgAAAI0"]
[Sun Nov 23 16:43:03.774805 2025] [:error] [pid 16066:tid 16092] [client 140.99.1.50:51941] [client 140.99.1.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "aSLJF_q-c47Q5mW5E9FpsAAAAZc"]
[Sun Nov 23 16:43:04.083636 2025] [:error] [pid 38740:tid 38802] [client 140.99.1.70:35337] [client 140.99.1.70] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "aSLJGA13QPZSi6O8umWW2gAAAIY"]
[Sun Nov 23 16:43:05.592292 2025] [:error] [pid 38738:tid 38760] [client 140.99.1.31:22219] [client 140.99.1.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "aSLJGQytc6TL9XavPmP8LQAAABI"]
[Sun Nov 23 16:43:07.519327 2025] [:error] [pid 14602:tid 14634] [client 140.99.1.39:42357] [client 140.99.1.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "aSLJGx-I77jdD81pU-mYVwAAAU0"]
[Sun Nov 23 16:43:07.804644 2025] [:error] [pid 16066:tid 16089] [client 140.99.1.63:25831] [client 140.99.1.63] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "aSLJG_q-c47Q5mW5E9Fp9gAAAZQ"]
[Sun Nov 23 17:36:21.426200 2025] [:error] [pid 44652:tid 44729] [client 176.65.132.18:36510] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aSLVldiQFwsyXQDhwyDlHAAAARc"]
[Mon Nov 24 01:52:32.436942 2025] [:error] [pid 1454:tid 1520] [client 176.65.132.18:56180] [client 176.65.132.18] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aSNJ4Leh4NH3skJ5n4R9nwAAAMg"]
[Mon Nov 24 03:48:36.720418 2025] [:error] [pid 56842:tid 56874] [client 193.37.33.68:59233] [client 193.37.33.68] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.37.33.68, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aSNlFPQ-3ytCdJAS2i7ouQAAAAU"]
[Mon Nov 24 04:48:36.251053 2025] [:error] [pid 12910:tid 12916] [client 52.236.123.156:39968] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "aSNzJGkWgvzAF2Nei2ViWAAAAAE"]
[Mon Nov 24 04:48:40.777348 2025] [:error] [pid 12910:tid 12923] [client 52.236.123.156:40092] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "aSNzKGkWgvzAF2Nei2ViXQAAAAg"]
[Mon Nov 24 04:48:44.055532 2025] [:error] [pid 12912:tid 12986] [client 52.236.123.156:40074] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "aSNzLJMj_Lgt36UonYKu3AAAAJE"]
[Mon Nov 24 04:48:47.148219 2025] [:error] [pid 12912:tid 12978] [client 52.236.123.156:39978] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "aSNzL5Mj_Lgt36UonYKu4AAAAIk"]
[Mon Nov 24 04:48:49.186800 2025] [:error] [pid 12910:tid 12939] [client 52.236.123.156:39954] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/marijuana.php"] [unique_id "aSNzMWkWgvzAF2Nei2ViYQAAABg"]
[Mon Nov 24 04:48:50.297995 2025] [:error] [pid 12912:tid 12989] [client 52.236.123.156:40068] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/marijuana.php"] [unique_id "aSNzMpMj_Lgt36UonYKu6QAAAJQ"]
[Mon Nov 24 04:50:50.589478 2025] [:error] [pid 12999:tid 13017] [client 52.236.123.156:40114] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nc4.php"] [unique_id "aSNzqltj_teEYJ8vu7H_ggAAAM4"]
[Mon Nov 24 04:51:15.680380 2025] [:error] [pid 12912:tid 12970] [client 52.236.123.156:56341] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/zmFM.php"] [unique_id "aSNzw5Mj_Lgt36UonYKviAAAAIE"]
[Mon Nov 24 04:51:17.792967 2025] [:error] [pid 12999:tid 13004] [client 52.236.123.156:39979] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSNzxVtj_teEYJ8vu7H_ngAAAME"]
[Mon Nov 24 04:51:22.942882 2025] [:error] [pid 12910:tid 12925] [client 52.236.123.156:39946] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSNzymkWgvzAF2Nei2VjPAAAAAo"]
[Mon Nov 24 04:51:28.885949 2025] [:error] [pid 12912:tid 12980] [client 52.236.123.156:56350] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/admin.php"] [unique_id "aSNz0JMj_Lgt36UonYKvlgAAAIs"]
[Mon Nov 24 04:51:31.538511 2025] [:error] [pid 12999:tid 13013] [client 52.236.123.156:39999] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/0.php"] [unique_id "aSNz01tj_teEYJ8vu7H_tAAAAMo"]
[Mon Nov 24 04:51:34.407816 2025] [:error] [pid 12912:tid 12978] [client 52.236.123.156:40090] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSNz1pMj_Lgt36UonYKvnQAAAIk"]
[Mon Nov 24 04:51:38.178186 2025] [:error] [pid 12910:tid 12915] [client 52.236.123.156:39967] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSNz2mkWgvzAF2Nei2VjWQAAAAA"]
[Mon Nov 24 04:51:42.798436 2025] [:error] [pid 12999:tid 13020] [client 52.236.123.156:39958] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSNz3ltj_teEYJ8vu7H_wQAAANE"]
[Mon Nov 24 04:51:45.081980 2025] [:error] [pid 12912:tid 12970] [client 52.236.123.156:56332] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plugins/Cache/footer.php"] [unique_id "aSNz4ZMj_Lgt36UonYKvrgAAAIE"]
[Mon Nov 24 04:51:48.862106 2025] [:error] [pid 12912:tid 12992] [client 52.236.123.156:40083] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aSNz5JMj_Lgt36UonYKvtgAAAJc"]
[Mon Nov 24 04:51:54.061911 2025] [:error] [pid 12910:tid 12931] [client 52.236.123.156:39991] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/404.php"] [unique_id "aSNz6mkWgvzAF2Nei2VjigAAABA"]
[Mon Nov 24 04:51:57.466339 2025] [:error] [pid 12911:tid 12955] [client 52.236.123.156:56336] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/404.php"] [unique_id "aSNz7UDMbk9464jnIl7cHQAAAE0"]
[Mon Nov 24 04:52:04.770214 2025] [:error] [pid 12999:tid 13016] [client 52.236.123.156:56377] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/404.php"] [unique_id "aSNz9Ftj_teEYJ8vu7H_7gAAAM0"]
[Mon Nov 24 04:52:08.036327 2025] [:error] [pid 12911:tid 12946] [client 52.236.123.156:56344] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/i1.php"] [unique_id "aSNz-EDMbk9464jnIl7cLwAAAEQ"]
[Mon Nov 24 04:52:10.586917 2025] [:error] [pid 12912:tid 12971] [client 52.236.123.156:40072] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/i1.php"] [unique_id "aSNz-pMj_Lgt36UonYKvxwAAAII"]
[Mon Nov 24 04:52:12.723388 2025] [:error] [pid 12910:tid 12918] [client 52.236.123.156:56324] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/i1.php"] [unique_id "aSNz_GkWgvzAF2Nei2VjqwAAAAM"]
[Mon Nov 24 04:52:30.415953 2025] [:error] [pid 12912:tid 12970] [client 52.236.123.156:40111] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/fm.php"] [unique_id "aSN0DpMj_Lgt36UonYKv5gAAAIE"]
[Mon Nov 24 04:52:34.005764 2025] [:error] [pid 12911:tid 12946] [client 52.236.123.156:56330] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/fm.php"] [unique_id "aSN0EkDMbk9464jnIl7cSAAAAEQ"]
[Mon Nov 24 04:52:38.928866 2025] [:error] [pid 12999:tid 13012] [client 52.236.123.156:56355] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/fm.php"] [unique_id "aSN0Fltj_teEYJ8vu7EAQAAAAMk"]
[Mon Nov 24 04:52:44.273646 2025] [:error] [pid 12911:tid 12950] [client 52.236.123.156:56339] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/fm.php"] [unique_id "aSN0HEDMbk9464jnIl7cTwAAAEg"]
[Mon Nov 24 04:52:47.384107 2025] [:error] [pid 12999:tid 13020] [client 52.236.123.156:40085] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/17.php"] [unique_id "aSN0H1tj_teEYJ8vu7EASgAAANE"]
[Mon Nov 24 04:52:53.443944 2025] [:error] [pid 12910:tid 12938] [client 52.236.123.156:56334] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/17.php"] [unique_id "aSN0JWkWgvzAF2Nei2Vj0QAAABc"]
[Mon Nov 24 04:52:57.297199 2025] [:error] [pid 12999:tid 13004] [client 52.236.123.156:56381] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/17.php"] [unique_id "aSN0KVtj_teEYJ8vu7EATgAAAME"]
[Mon Nov 24 04:53:16.548359 2025] [:error] [pid 12912:tid 12981] [client 52.236.123.156:39978] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/0.php"] [unique_id "aSN0PJMj_Lgt36UonYKwJgAAAIw"]
[Mon Nov 24 04:53:19.391180 2025] [:error] [pid 12912:tid 12971] [client 52.236.123.156:56325] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSN0P5Mj_Lgt36UonYKwLgAAAII"]
[Mon Nov 24 04:53:23.878637 2025] [:error] [pid 12911:tid 12964] [client 52.236.123.156:39982] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSN0Q0DMbk9464jnIl7ceQAAAFY"]
[Mon Nov 24 04:53:26.438880 2025] [:error] [pid 12999:tid 13022] [client 52.236.123.156:56374] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/Mailer.php"] [unique_id "aSN0Rltj_teEYJ8vu7EAbAAAANM"]
[Mon Nov 24 04:53:36.762202 2025] [:error] [pid 12911:tid 12952] [client 52.236.123.156:56323] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aSN0UEDMbk9464jnIl7clAAAAEo"]
[Mon Nov 24 04:54:00.807622 2025] [:error] [pid 12999:tid 13026] [client 52.236.123.156:40581] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/10.php"] [unique_id "aSN0aFtj_teEYJ8vu7EAmwAAANc"]
[Mon Nov 24 04:54:07.289809 2025] [:error] [pid 12912:tid 12971] [client 52.236.123.156:56335] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/10.php"] [unique_id "aSN0b5Mj_Lgt36UonYKwfwAAAII"]
[Mon Nov 24 04:54:12.767212 2025] [:error] [pid 12999:tid 13020] [client 52.236.123.156:56342] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/10.php"] [unique_id "aSN0dFtj_teEYJ8vu7EAswAAANE"]
[Mon Nov 24 04:54:15.713630 2025] [:error] [pid 12999:tid 13010] [client 52.236.123.156:40589] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goat1.php"] [unique_id "aSN0d1tj_teEYJ8vu7EAuwAAAMc"]
[Mon Nov 24 04:54:19.405618 2025] [:error] [pid 12911:tid 12957] [client 52.236.123.156:40075] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goat1.php"] [unique_id "aSN0e0DMbk9464jnIl7cpAAAAE8"]
[Mon Nov 24 04:54:23.697109 2025] [:error] [pid 12910:tid 12939] [client 52.236.123.156:39998] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goat1.php"] [unique_id "aSN0f2kWgvzAF2Nei2VkEQAAABg"]
[Mon Nov 24 04:54:28.120329 2025] [:error] [pid 12911:tid 12956] [client 52.236.123.156:56329] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goat1.php"] [unique_id "aSN0hEDMbk9464jnIl7crgAAAE4"]
[Mon Nov 24 04:55:15.543137 2025] [:error] [pid 12999:tid 13009] [client 52.236.123.156:39947] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "aSN0s1tj_teEYJ8vu7EBHQAAAMY"]
[Mon Nov 24 04:55:26.736096 2025] [:error] [pid 12910:tid 12936] [client 52.236.123.156:56351] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "aSN0vmkWgvzAF2Nei2VkRgAAABU"]
[Mon Nov 24 04:55:30.375117 2025] [:error] [pid 12912:tid 12990] [client 52.236.123.156:39980] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "aSN0wpMj_Lgt36UonYKxDQAAAJU"]
[Mon Nov 24 04:55:33.094141 2025] [:error] [pid 12999:tid 13005] [client 52.236.123.156:40122] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uploads/multi.php"] [unique_id "aSN0xVtj_teEYJ8vu7EBMgAAAMI"]
[Mon Nov 24 04:55:35.306381 2025] [:error] [pid 12910:tid 12920] [client 52.236.123.156:40104] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uploads/multi.php"] [unique_id "aSN0x2kWgvzAF2Nei2VkSwAAAAU"]
[Mon Nov 24 04:55:38.275624 2025] [:error] [pid 12999:tid 13027] [client 52.236.123.156:40615] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uploads/multi.php"] [unique_id "aSN0yltj_teEYJ8vu7EBOAAAANg"]
[Mon Nov 24 04:55:40.261647 2025] [:error] [pid 12911:tid 12946] [client 52.236.123.156:40067] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uploads/multi.php"] [unique_id "aSN0zEDMbk9464jnIl7dSgAAAEQ"]
[Mon Nov 24 04:55:41.771169 2025] [:error] [pid 12910:tid 12916] [client 52.236.123.156:56362] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/3.php"] [unique_id "aSN0zWkWgvzAF2Nei2VkUwAAAAE"]
[Mon Nov 24 04:55:46.071029 2025] [:error] [pid 12910:tid 12934] [client 52.236.123.156:40655] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/3.php"] [unique_id "aSN00mkWgvzAF2Nei2VkXwAAABM"]
[Mon Nov 24 04:55:51.542969 2025] [:error] [pid 12912:tid 12977] [client 52.236.123.156:39986] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/3.php"] [unique_id "aSN015Mj_Lgt36UonYKxJAAAAIg"]
[Mon Nov 24 04:55:52.497607 2025] [:error] [pid 12912:tid 12974] [client 52.236.123.156:39986] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/3.php"] [unique_id "aSN02JMj_Lgt36UonYKxKQAAAIU"]
[Mon Nov 24 04:55:54.738904 2025] [:error] [pid 12911:tid 12953] [client 52.236.123.156:39999] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin/uploads/images/autoload_classmap.php"] [unique_id "aSN02kDMbk9464jnIl7dYQAAAEs"]
[Mon Nov 24 04:55:56.431567 2025] [:error] [pid 12912:tid 12982] [client 52.236.123.156:39977] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin/uploads/images/autoload_classmap.php"] [unique_id "aSN03JMj_Lgt36UonYKxKwAAAI0"]
[Mon Nov 24 04:55:57.946418 2025] [:error] [pid 12910:tid 12934] [client 52.236.123.156:39957] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin/uploads/images/autoload_classmap.php"] [unique_id "aSN03WkWgvzAF2Nei2VkbgAAABM"]
[Mon Nov 24 04:56:01.760888 2025] [:error] [pid 12912:tid 12977] [client 52.236.123.156:40073] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin/uploads/images/autoload_classmap.php"] [unique_id "aSN04ZMj_Lgt36UonYKxNAAAAIg"]
[Mon Nov 24 04:56:47.488009 2025] [:error] [pid 12999:tid 13008] [client 52.236.123.156:39987] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/403.php"] [unique_id "aSN1D1tj_teEYJ8vu7EBzwAAAMU"]
[Mon Nov 24 04:56:49.613253 2025] [:error] [pid 12911:tid 12949] [client 52.236.123.156:39950] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/403.php"] [unique_id "aSN1EUDMbk9464jnIl7drwAAAEc"]
[Mon Nov 24 04:56:53.577357 2025] [:error] [pid 12912:tid 12977] [client 52.236.123.156:39991] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/403.php"] [unique_id "aSN1FZMj_Lgt36UonYKxjAAAAIg"]
[Mon Nov 24 04:56:56.394142 2025] [:error] [pid 12999:tid 13015] [client 52.236.123.156:40092] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/403.php"] [unique_id "aSN1GFtj_teEYJ8vu7EB6wAAAMw"]
[Mon Nov 24 04:56:57.832003 2025] [:error] [pid 12999:tid 13016] [client 52.236.123.156:40085] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSN1GVtj_teEYJ8vu7EB8QAAAM0"]
[Mon Nov 24 04:56:59.629419 2025] [:error] [pid 12910:tid 12922] [client 52.236.123.156:40080] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSN1G2kWgvzAF2Nei2Vk1AAAAAc"]
[Mon Nov 24 04:57:09.588369 2025] [:error] [pid 12999:tid 13007] [client 52.236.123.156:39951] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/gecko-litespeed.php"] [unique_id "aSN1JVtj_teEYJ8vu7ECBAAAAMQ"]
[Mon Nov 24 04:57:15.100303 2025] [:error] [pid 12999:tid 13024] [client 52.236.123.156:40082] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock360.php"] [unique_id "aSN1K1tj_teEYJ8vu7ECEwAAANU"]
[Mon Nov 24 04:57:18.644156 2025] [:error] [pid 12999:tid 13013] [client 52.236.123.156:40120] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock360.php"] [unique_id "aSN1Lltj_teEYJ8vu7ECGwAAAMo"]
[Mon Nov 24 04:57:23.454240 2025] [:error] [pid 12999:tid 13026] [client 52.236.123.156:56330] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock360.php"] [unique_id "aSN1M1tj_teEYJ8vu7ECIAAAANc"]
[Mon Nov 24 04:57:26.848725 2025] [:error] [pid 12999:tid 13016] [client 52.236.123.156:40094] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock360.php"] [unique_id "aSN1Nltj_teEYJ8vu7ECJwAAAM0"]
[Mon Nov 24 04:57:28.880589 2025] [:error] [pid 12910:tid 12924] [client 52.236.123.156:39992] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/up.php"] [unique_id "aSN1OGkWgvzAF2Nei2Vk7gAAAAk"]
[Mon Nov 24 04:57:35.628576 2025] [:error] [pid 12912:tid 12983] [client 52.236.123.156:56325] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/up.php"] [unique_id "aSN1P5Mj_Lgt36UonYKxwQAAAI4"]
[Mon Nov 24 04:57:40.690181 2025] [:error] [pid 12999:tid 13019] [client 52.236.123.156:56336] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/up.php"] [unique_id "aSN1RFtj_teEYJ8vu7ECPAAAANA"]
[Mon Nov 24 04:57:43.897095 2025] [:error] [pid 12999:tid 13027] [client 52.236.123.156:40582] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sim.php"] [unique_id "aSN1R1tj_teEYJ8vu7ECQAAAANg"]
[Mon Nov 24 04:57:59.027055 2025] [:error] [pid 12910:tid 12931] [client 52.236.123.156:56346] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aSN1V2kWgvzAF2Nei2VlHQAAABA"]
[Mon Nov 24 04:58:18.426484 2025] [:error] [pid 12999:tid 13008] [client 52.236.123.156:40098] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ll.php"] [unique_id "aSN1altj_teEYJ8vu7ECcQAAAMU"]
[Mon Nov 24 04:59:35.878388 2025] [:error] [pid 12910:tid 12928] [client 52.236.123.156:39968] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aSN1t2kWgvzAF2Nei2VllwAAAA0"]
[Mon Nov 24 04:59:41.313827 2025] [:error] [pid 12910:tid 12935] [client 52.236.123.156:56327] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v4.php"] [unique_id "aSN1vWkWgvzAF2Nei2VloQAAABQ"]
[Mon Nov 24 04:59:43.885194 2025] [:error] [pid 12910:tid 12937] [client 52.236.123.156:39975] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v4.php"] [unique_id "aSN1v2kWgvzAF2Nei2VlowAAABY"]
[Mon Nov 24 04:59:49.710882 2025] [:error] [pid 12912:tid 12992] [client 52.236.123.156:56322] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v4.php"] [unique_id "aSN1xZMj_Lgt36UonYKyNwAAAJc"]
[Mon Nov 24 04:59:52.536670 2025] [:error] [pid 12910:tid 12930] [client 52.236.123.156:40614] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mn.php"] [unique_id "aSN1yGkWgvzAF2Nei2VltQAAAA8"]
[Mon Nov 24 04:59:54.587786 2025] [:error] [pid 12999:tid 13017] [client 52.236.123.156:40097] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mn.php"] [unique_id "aSN1yltj_teEYJ8vu7EC5wAAAM4"]
[Mon Nov 24 04:59:56.384772 2025] [:error] [pid 12999:tid 13025] [client 52.236.123.156:40116] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mn.php"] [unique_id "aSN1zFtj_teEYJ8vu7EC7QAAANY"]
[Mon Nov 24 04:59:59.095347 2025] [:error] [pid 12911:tid 12959] [client 52.236.123.156:40114] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mn.php"] [unique_id "aSN1z0DMbk9464jnIl7eXQAAAFE"]
[Mon Nov 24 05:00:03.459872 2025] [:error] [pid 12912:tid 12969] [client 52.236.123.156:40108] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "aSN105Mj_Lgt36UonYKyRAAAAIA"]
[Mon Nov 24 05:00:07.168647 2025] [:error] [pid 12911:tid 12960] [client 52.236.123.156:40077] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "aSN110DMbk9464jnIl7ecQAAAFI"]
[Mon Nov 24 05:00:09.208414 2025] [:error] [pid 12911:tid 12942] [client 52.236.123.156:56324] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "aSN12UDMbk9464jnIl7eewAAAEA"]
[Mon Nov 24 05:00:10.520510 2025] [:error] [pid 12911:tid 12962] [client 52.236.123.156:40123] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "aSN12kDMbk9464jnIl7ehAAAAFQ"]
[Mon Nov 24 05:00:12.179866 2025] [:error] [pid 12910:tid 12921] [client 52.236.123.156:56329] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ALFA_DATA/index.php"] [unique_id "aSN13GkWgvzAF2Nei2Vl1AAAAAY"]
[Mon Nov 24 05:00:16.640092 2025] [:error] [pid 12910:tid 12923] [client 52.236.123.156:40106] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ALFA_DATA/index.php"] [unique_id "aSN14GkWgvzAF2Nei2Vl2AAAAAg"]
[Mon Nov 24 05:01:12.662394 2025] [:error] [pid 12910:tid 12917] [client 52.236.123.156:39991] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSN2GGkWgvzAF2Nei2VmAwAAAAI"]
[Mon Nov 24 05:01:14.412237 2025] [:error] [pid 12999:tid 13024] [client 52.236.123.156:56335] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSN2Gltj_teEYJ8vu7EDcwAAANU"]
[Mon Nov 24 05:01:18.975160 2025] [:error] [pid 12910:tid 12921] [client 52.236.123.156:40081] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSN2HmkWgvzAF2Nei2VmBgAAAAY"]
[Mon Nov 24 05:01:21.743999 2025] [:error] [pid 12912:tid 12988] [client 52.236.123.156:39987] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/wp-conflg.php"] [unique_id "aSN2IZMj_Lgt36UonYKykwAAAJM"]
[Mon Nov 24 05:01:23.475684 2025] [:error] [pid 12999:tid 13010] [client 52.236.123.156:40121] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/usage-file.php"] [unique_id "aSN2I1tj_teEYJ8vu7EDgQAAAMc"]
[Mon Nov 24 05:01:26.776790 2025] [:error] [pid 12911:tid 12960] [client 52.236.123.156:40075] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/usage-file.php"] [unique_id "aSN2JkDMbk9464jnIl7e2wAAAFI"]
[Mon Nov 24 05:01:47.680265 2025] [:error] [pid 12912:tid 12974] [client 52.236.123.156:39966] [client 52.236.123.156] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/assets/js/wp-config.php"] [unique_id "aSN2O5Mj_Lgt36UonYKyoQAAAIU"]
[Mon Nov 24 05:01:50.328372 2025] [:error] [pid 12910:tid 12935] [client 52.236.123.156:40085] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Js.php"] [unique_id "aSN2PmkWgvzAF2Nei2VmGAAAABQ"]
[Mon Nov 24 05:01:57.708516 2025] [:error] [pid 12999:tid 13027] [client 52.236.123.156:40090] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Js.php"] [unique_id "aSN2RVtj_teEYJ8vu7EDswAAANg"]
[Mon Nov 24 05:01:59.852076 2025] [:error] [pid 12910:tid 12933] [client 52.236.123.156:40602] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Js.php"] [unique_id "aSN2R2kWgvzAF2Nei2VmJAAAABI"]
[Mon Nov 24 05:02:02.298196 2025] [:error] [pid 12912:tid 12981] [client 52.236.123.156:39986] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Js.php"] [unique_id "aSN2SpMj_Lgt36UonYKywgAAAIw"]
[Mon Nov 24 05:02:04.873876 2025] [:error] [pid 12999:tid 13003] [client 52.236.123.156:39997] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/menu.php"] [unique_id "aSN2TFtj_teEYJ8vu7EDyQAAAMA"]
[Mon Nov 24 05:02:07.940610 2025] [:error] [pid 12999:tid 13007] [client 52.236.123.156:40113] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/menu.php"] [unique_id "aSN2T1tj_teEYJ8vu7ED1wAAAMQ"]
[Mon Nov 24 05:02:09.215853 2025] [:error] [pid 12912:tid 12987] [client 52.236.123.156:40113] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/menu.php"] [unique_id "aSN2UZMj_Lgt36UonYKy3wAAAJI"]
[Mon Nov 24 05:02:11.338716 2025] [:error] [pid 12999:tid 13004] [client 52.236.123.156:39993] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/menu.php"] [unique_id "aSN2U1tj_teEYJ8vu7ED2gAAAME"]
[Mon Nov 24 05:02:32.517852 2025] [:error] [pid 12912:tid 12989] [client 52.236.123.156:56326] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/build.php"] [unique_id "aSN2aJMj_Lgt36UonYKy9gAAAJQ"]
[Mon Nov 24 05:02:35.173417 2025] [:error] [pid 12999:tid 13018] [client 52.236.123.156:40071] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/build.php"] [unique_id "aSN2a1tj_teEYJ8vu7ED_gAAAM8"]
[Mon Nov 24 05:02:36.582467 2025] [:error] [pid 12912:tid 12973] [client 52.236.123.156:40095] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/build.php"] [unique_id "aSN2bJMj_Lgt36UonYKy-QAAAIQ"]
[Mon Nov 24 05:02:39.486955 2025] [:error] [pid 12912:tid 12990] [client 52.236.123.156:39950] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ab.php"] [unique_id "aSN2b5Mj_Lgt36UonYKy-wAAAJU"]
[Mon Nov 24 05:02:42.325809 2025] [:error] [pid 12999:tid 13003] [client 52.236.123.156:39994] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ab.php"] [unique_id "aSN2cltj_teEYJ8vu7EEBQAAAMA"]
[Mon Nov 24 05:02:43.349914 2025] [:error] [pid 12999:tid 13007] [client 52.236.123.156:40105] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ab.php"] [unique_id "aSN2c1tj_teEYJ8vu7EEBwAAAMQ"]
[Mon Nov 24 05:03:00.402434 2025] [:error] [pid 12912:tid 12972] [client 52.236.123.156:56370] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ahax.php"] [unique_id "aSN2hJMj_Lgt36UonYKzCQAAAIM"]
[Mon Nov 24 05:03:02.271727 2025] [:error] [pid 12910:tid 12929] [client 52.236.123.156:39938] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ahax.php"] [unique_id "aSN2hmkWgvzAF2Nei2VmVQAAAA4"]
[Mon Nov 24 05:03:06.218505 2025] [:error] [pid 12999:tid 13003] [client 52.236.123.156:39982] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ahax.php"] [unique_id "aSN2iltj_teEYJ8vu7EEMAAAAMA"]
[Mon Nov 24 06:10:48.896131 2025] [:error] [pid 12911:tid 12951] [client 52.236.123.156:35923] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSOGaEDMbk9464jnIl7wyQAAAEk"]
[Mon Nov 24 06:10:50.115029 2025] [:error] [pid 12911:tid 12957] [client 52.236.123.156:35934] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSOGakDMbk9464jnIl7wywAAAE8"]
[Mon Nov 24 06:10:58.200971 2025] [:error] [pid 53508:tid 53516] [client 52.236.123.156:35933] [client 52.236.123.156] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aSOGcm639qxbKCcL09zFYQAAAQY"]
[Mon Nov 24 08:21:00.379301 2025] [:error] [pid 48599:tid 48610] [client 103.65.237.124:57286] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "aSOk7Jzvu6PDJiRKE3KrKAAAAYc"]
[Mon Nov 24 08:21:00.662902 2025] [:error] [pid 48599:tid 48624] [client 103.65.237.124:52264] [client 103.65.237.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aSOk7Jzvu6PDJiRKE3KrKgAAAZU"]
[Mon Nov 24 20:27:19.055636 2025] [:error] [pid 49900:tid 49915] [client 185.75.71.209:56762] [client 185.75.71.209] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.75.71.209, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRPJzCyPLrvg06aork46QAAAA0"], referer: http://paramountestate.com.au
[Mon Nov 24 21:02:35.667833 2025] [autoindex:error] [pid 16593:tid 16610] [client 104.209.254.219:1400] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Mon Nov 24 21:14:25.596614 2025] [:error] [pid 9630:tid 9646] [client 34.76.142.88:51722] [client 34.76.142.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 34.76.142.88, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRaMSrSgUgPGkizt2ouywAAAE4"], referer: http://paramountestate.com.au
[Mon Nov 24 21:31:58.594509 2025] [:error] [pid 16516:tid 16535] [client 103.124.95.168:38184] [client 103.124.95.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.124.95.168, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSReTvqZbniwaNwL8XkKRgAAARA"], referer: http://paramountestate.com.au
[Mon Nov 24 21:36:08.008166 2025] [:error] [pid 48601:tid 48670] [client 103.56.162.159:33704] [client 103.56.162.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.56.162.159, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRfSIMM4MaVTk74-AbkbQAAAg0"], referer: http://paramountestate.com.au
[Mon Nov 24 21:44:39.129043 2025] [:error] [pid 16549:tid 16558] [client 62.214.228.95:60402] [client 62.214.228.95] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 62.214.228.95, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRhR6eWW19A99PUw_dnwQAAAUY"], referer: http://paramountestate.com.au
[Mon Nov 24 21:48:51.360252 2025] [:error] [pid 16441:tid 16453] [client 203.209.212.46:49408] [client 203.209.212.46] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 203.209.212.46, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRiQ4q_bc5MOa9HflmU1AAAAIk"], referer: http://paramountestate.com.au
[Mon Nov 24 21:53:07.250826 2025] [:error] [pid 9630:tid 9639] [client 20.151.56.195:60346] [client 20.151.56.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.151.56.195, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRjQyrSgUgPGkizt2o7AQAAAEc"], referer: http://paramountestate.com.au
[Mon Nov 24 21:57:29.333462 2025] [:error] [pid 16516:tid 16527] [client 103.31.38.163:50290] [client 103.31.38.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.31.38.163, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRkSfqZbniwaNwL8XkO1QAAAQg"], referer: http://paramountestate.com.au
[Mon Nov 24 22:01:39.400668 2025] [:error] [pid 16549:tid 16568] [client 18.229.229.99:35684] [client 18.229.229.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 18.229.229.99, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRlQ6eWW19A99PUw_dquwAAAVA"], referer: http://paramountestate.com.au
[Mon Nov 24 22:14:30.811611 2025] [:error] [pid 16441:tid 16446] [client 116.118.45.196:37368] [client 116.118.45.196] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 116.118.45.196, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRoRoq_bc5MOa9HflmecQAAAII"], referer: http://paramountestate.com.au
[Mon Nov 24 22:22:58.143651 2025] [:error] [pid 49900:tid 49904] [client 142.44.138.99:36642] [client 142.44.138.99] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 142.44.138.99, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRqQjCyPLrvg06aorlRCQAAAAI"], referer: http://paramountestate.com.au
[Mon Nov 24 22:48:21.291817 2025] [:error] [pid 9630:tid 9649] [client 81.88.53.43:52242] [client 81.88.53.43] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.88.53.43, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSRwNSrSgUgPGkizt2pJlAAAAFE"], referer: http://paramountestate.com.au
[Mon Nov 24 23:18:22.813779 2025] [:error] [pid 49900:tid 49921] [client 91.213.188.13:58320] [client 91.213.188.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.213.188.13, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSR3PjCyPLrvg06aorleUwAAABM"], referer: http://paramountestate.com.au
[Mon Nov 24 23:43:19.820496 2025] [:error] [pid 49900:tid 49909] [client 104.248.45.30:33348] [client 104.248.45.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.45.30, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSR9FzCyPLrvg06aorlkIQAAAAc"], referer: http://paramountestate.com.au
[Tue Nov 25 00:35:45.058784 2025] [:error] [pid 9630:tid 9650] [client 159.223.46.114:53242] [client 159.223.46.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.46.114, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSSJYSrSgUgPGkizt2pjoQAAAFI"], referer: http://paramountestate.com.au
[Tue Nov 25 00:39:41.714171 2025] [:error] [pid 48600:tid 48643] [client 103.56.162.159:42786] [client 103.56.162.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.56.162.159, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSSKTftOzSUAQvWVjBe5hgAAAc0"], referer: http://paramountestate.com.au
[Tue Nov 25 02:03:31.231711 2025] [:error] [pid 49900:tid 49923] [client 104.219.248.116:43974] [client 104.219.248.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.219.248.116, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSSd8zCyPLrvg06aormAPAAAABU"], referer: http://paramountestate.com.au
[Tue Nov 25 02:07:16.319258 2025] [:error] [pid 49900:tid 49909] [client 68.72.143.114:44188] [client 68.72.143.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.72.143.114, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSSe1DCyPLrvg06aormBHAAAAAc"], referer: http://paramountestate.com.au
[Tue Nov 25 02:44:05.955049 2025] [:error] [pid 9630:tid 9633] [client 50.6.155.60:17158] [client 50.6.155.60] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.6.155.60, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSSndSrSgUgPGkizt2qAwQAAAEE"], referer: http://paramountestate.com.au
[Tue Nov 25 03:00:44.834511 2025] [:error] [pid 49900:tid 49918] [client 192.185.2.102:41866] [client 192.185.2.102] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.185.2.102, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSSrXDCyPLrvg06aormMBgAAABA"], referer: http://paramountestate.com.au
[Tue Nov 25 03:08:10.686159 2025] [:error] [pid 49900:tid 49922] [client 159.223.46.114:51008] [client 159.223.46.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 159.223.46.114, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSStGjCyPLrvg06aormOUAAAABQ"], referer: http://paramountestate.com.au
[Tue Nov 25 03:12:01.248364 2025] [:error] [pid 16441:tid 16460] [client 103.56.162.159:59616] [client 103.56.162.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.56.162.159, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSSuAYq_bc5MOa9Hfln-NwAAAJA"], referer: http://paramountestate.com.au
[Tue Nov 25 03:36:29.058378 2025] [:error] [pid 30783:tid 30862] [client 20.10.155.243:4083] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cyanamids.php"] [unique_id "aSSzvd3oFLZhRUZW1vzrggAAAJA"]
[Tue Nov 25 03:36:34.415134 2025] [:error] [pid 33474:tid 33477] [client 20.10.155.243:2566] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cyanamids.php"] [unique_id "aSSzwrRfYt5X3GZs3zafSQAAAQA"]
[Tue Nov 25 03:36:37.278449 2025] [:error] [pid 33474:tid 33479] [client 20.10.155.243:3796] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cyanamids.php"] [unique_id "aSSzxbRfYt5X3GZs3zaffQAAAQI"]
[Tue Nov 25 03:36:48.335085 2025] [:error] [pid 30879:tid 30891] [client 20.10.155.243:4084] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xl6.php"] [unique_id "aSSz0Le3-juUJ90ov0hVCQAAAMo"]
[Tue Nov 25 03:39:49.351432 2025] [:error] [pid 61528:tid 61540] [client 20.10.155.243:1196] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/unwattled.php"] [unique_id "aSS0hZmXyiOE_lMDJTNFhgAAAMo"]
[Tue Nov 25 03:39:51.625102 2025] [:error] [pid 61433:tid 61508] [client 20.10.155.243:5669] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/unwattled.php"] [unique_id "aSS0h01nb5r2eDXSMnSzWwAAAIs"]
[Tue Nov 25 03:39:52.808242 2025] [:error] [pid 61528:tid 61554] [client 20.10.155.243:4519] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/unwattled.php"] [unique_id "aSS0iJmXyiOE_lMDJTNFkAAAANg"]
[Tue Nov 25 03:40:03.180883 2025] [:error] [pid 61431:tid 61447] [client 20.10.155.243:1085] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/x.php"] [unique_id "aSS0k9ISJUjxNuXBMNC_wgAAAAw"]
[Tue Nov 25 03:40:06.996516 2025] [:error] [pid 61432:tid 61472] [client 20.10.155.243:6288] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/x.php"] [unique_id "aSS0lmjoHc8OYPguMSCtTgAAAEI"]
[Tue Nov 25 03:40:11.508241 2025] [:error] [pid 61433:tid 61513] [client 20.10.155.243:3351] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/x.php"] [unique_id "aSS0m01nb5r2eDXSMnSzdQAAAJA"]
[Tue Nov 25 03:40:14.555266 2025] [:error] [pid 61432:tid 61476] [client 20.10.155.243:1030] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "aSS0nmjoHc8OYPguMSCtXAAAAEY"]
[Tue Nov 25 03:40:16.713416 2025] [:error] [pid 61433:tid 61503] [client 20.10.155.243:1588] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "aSS0oE1nb5r2eDXSMnSzeQAAAIY"]
[Tue Nov 25 03:40:19.543117 2025] [:error] [pid 61432:tid 61482] [client 20.10.155.243:3658] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "aSS0o2joHc8OYPguMSCtaAAAAEw"]
[Tue Nov 25 03:40:21.668384 2025] [:error] [pid 61432:tid 61487] [client 20.10.155.243:1061] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "aSS0pWjoHc8OYPguMSCtcAAAAFE"]
[Tue Nov 25 03:40:22.752091 2025] [:error] [pid 61528:tid 61544] [client 20.10.155.243:4845] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/twohandedness.php"] [unique_id "aSS0ppmXyiOE_lMDJTNFvQAAAM4"]
[Tue Nov 25 03:40:23.688509 2025] [:error] [pid 61432:tid 61492] [client 20.10.155.243:1156] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/twohandedness.php"] [unique_id "aSS0p2joHc8OYPguMSCtcwAAAFY"]
[Tue Nov 25 03:40:24.555080 2025] [:error] [pid 61528:tid 61546] [client 20.10.155.243:6439] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/twohandedness.php"] [unique_id "aSS0qJmXyiOE_lMDJTNFwgAAANA"]
[Tue Nov 25 03:40:26.866863 2025] [:error] [pid 61528:tid 61536] [client 20.10.155.243:5655] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/twohandedness.php"] [unique_id "aSS0qpmXyiOE_lMDJTNFxgAAAMY"]
[Tue Nov 25 03:40:28.139981 2025] [:error] [pid 61433:tid 61506] [client 20.10.155.243:5651] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/acholuria.php"] [unique_id "aSS0rE1nb5r2eDXSMnSzggAAAIk"]
[Tue Nov 25 03:40:30.274277 2025] [:error] [pid 61432:tid 61479] [client 20.10.155.243:5604] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/acholuria.php"] [unique_id "aSS0rmjoHc8OYPguMSCtfAAAAEk"]
[Tue Nov 25 03:40:32.197184 2025] [:error] [pid 61432:tid 61493] [client 20.10.155.243:4816] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/acholuria.php"] [unique_id "aSS0sGjoHc8OYPguMSCtgAAAAFc"]
[Tue Nov 25 03:40:34.138456 2025] [:error] [pid 61431:tid 61444] [client 20.10.155.243:5686] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/acholuria.php"] [unique_id "aSS0stISJUjxNuXBMNC_-wAAAAk"]
[Tue Nov 25 03:40:35.461423 2025] [:error] [pid 61431:tid 61447] [client 20.10.155.243:4522] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock360.php"] [unique_id "aSS0s9ISJUjxNuXBMNC__gAAAAw"]
[Tue Nov 25 03:41:19.983959 2025] [:error] [pid 61431:tid 61448] [client 20.10.155.243:1662] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bn.php"] [unique_id "aSS039ISJUjxNuXBMNDAXAAAAA0"]
[Tue Nov 25 03:41:24.001483 2025] [:error] [pid 61431:tid 61454] [client 20.10.155.243:3889] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bn.php"] [unique_id "aSS049ISJUjxNuXBMNDAYAAAABM"]
[Tue Nov 25 03:41:27.526060 2025] [:error] [pid 61528:tid 61545] [client 20.10.155.243:2259] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bn.php"] [unique_id "aSS055mXyiOE_lMDJTNGMwAAAM8"]
[Tue Nov 25 03:41:32.870748 2025] [:error] [pid 61433:tid 61497] [client 20.10.155.243:4625] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bn.php"] [unique_id "aSS07E1nb5r2eDXSMnSz5QAAAIA"]
[Tue Nov 25 03:41:34.823817 2025] [:error] [pid 61432:tid 61492] [client 20.10.155.243:5850] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lanbai.php"] [unique_id "aSS07mjoHc8OYPguMSCtxgAAAFY"]
[Tue Nov 25 03:41:38.616970 2025] [:error] [pid 61432:tid 61472] [client 20.10.155.243:4776] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lanbai.php"] [unique_id "aSS08mjoHc8OYPguMSCtyAAAAEI"]
[Tue Nov 25 03:41:42.400335 2025] [:error] [pid 61528:tid 61532] [client 20.10.155.243:5084] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lanbai.php"] [unique_id "aSS09pmXyiOE_lMDJTNGPwAAAMI"]
[Tue Nov 25 03:41:44.455267 2025] [:error] [pid 61528:tid 61538] [client 20.10.155.243:5366] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lanbai.php"] [unique_id "aSS0-JmXyiOE_lMDJTNGRAAAAMg"]
[Tue Nov 25 03:41:47.055743 2025] [:error] [pid 61528:tid 61552] [client 20.10.155.243:5965] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/speculative.php"] [unique_id "aSS0-5mXyiOE_lMDJTNGSAAAANY"]
[Tue Nov 25 03:41:49.873024 2025] [:error] [pid 61431:tid 61447] [client 20.10.155.243:4631] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/speculative.php"] [unique_id "aSS0_dISJUjxNuXBMNDAcwAAAAw"]
[Tue Nov 25 03:41:52.474654 2025] [:error] [pid 61432:tid 61492] [client 20.10.155.243:4621] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/speculative.php"] [unique_id "aSS1AGjoHc8OYPguMSCt5AAAAFY"]
[Tue Nov 25 03:41:53.111887 2025] [:error] [pid 61433:tid 61501] [client 20.10.155.243:6571] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/speculative.php"] [unique_id "aSS1AU1nb5r2eDXSMnSz9gAAAIQ"]
[Tue Nov 25 03:41:53.846910 2025] [:error] [pid 61433:tid 61507] [client 20.10.155.243:5925] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/starry.php"] [unique_id "aSS1AU1nb5r2eDXSMnSz-AAAAIo"]
[Tue Nov 25 03:41:55.248838 2025] [:error] [pid 61431:tid 61442] [client 20.10.155.243:2638] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/starry.php"] [unique_id "aSS1A9ISJUjxNuXBMNDAeAAAAAc"]
[Tue Nov 25 03:41:57.040284 2025] [:error] [pid 61528:tid 61536] [client 20.10.155.243:6007] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/starry.php"] [unique_id "aSS1BZmXyiOE_lMDJTNGVAAAAMY"]
[Tue Nov 25 03:41:59.391259 2025] [:error] [pid 61433:tid 61499] [client 20.10.155.243:1956] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/starry.php"] [unique_id "aSS1B01nb5r2eDXSMnS0AQAAAII"]
[Tue Nov 25 03:42:02.276247 2025] [:error] [pid 61432:tid 61484] [client 20.10.155.243:6729] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/unsafer.php"] [unique_id "aSS1CmjoHc8OYPguMSCt7wAAAE4"]
[Tue Nov 25 03:42:08.012455 2025] [:error] [pid 61528:tid 61533] [client 20.10.155.243:2674] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/unsafer.php"] [unique_id "aSS1EJmXyiOE_lMDJTNGXAAAAMM"]
[Tue Nov 25 03:42:11.035701 2025] [:error] [pid 61528:tid 61549] [client 20.10.155.243:2673] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/unsafer.php"] [unique_id "aSS1E5mXyiOE_lMDJTNGYQAAANM"]
[Tue Nov 25 03:42:13.947698 2025] [:error] [pid 61431:tid 61446] [client 20.10.155.243:5833] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/unsafer.php"] [unique_id "aSS1FdISJUjxNuXBMNDAigAAAAs"]
[Tue Nov 25 03:43:18.662225 2025] [:error] [pid 61431:tid 61453] [client 20.10.155.243:4285] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/disquiet.php"] [unique_id "aSS1VtISJUjxNuXBMNDBLQAAABI"]
[Tue Nov 25 03:43:20.401029 2025] [:error] [pid 61433:tid 61499] [client 20.10.155.243:4245] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/disquiet.php"] [unique_id "aSS1WE1nb5r2eDXSMnS0nAAAAII"]
[Tue Nov 25 03:43:22.228294 2025] [:error] [pid 61433:tid 61517] [client 20.10.155.243:3426] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/disquiet.php"] [unique_id "aSS1Wk1nb5r2eDXSMnS0nwAAAJQ"]
[Tue Nov 25 03:43:25.261818 2025] [:error] [pid 61528:tid 61533] [client 20.10.155.243:2920] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/disquiet.php"] [unique_id "aSS1XZmXyiOE_lMDJTNGywAAAMM"]
[Tue Nov 25 03:43:27.349814 2025] [:error] [pid 61528:tid 61539] [client 20.10.155.243:2372] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-advaced.php"] [unique_id "aSS1X5mXyiOE_lMDJTNGzgAAAMk"]
[Tue Nov 25 03:43:30.724766 2025] [:error] [pid 61432:tid 61481] [client 20.10.155.243:2401] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-advaced.php"] [unique_id "aSS1YmjoHc8OYPguMSCuhAAAAEs"]
[Tue Nov 25 03:43:35.103981 2025] [:error] [pid 61528:tid 61543] [client 20.10.155.243:1928] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-advaced.php"] [unique_id "aSS1Z5mXyiOE_lMDJTNG2gAAAM0"]
[Tue Nov 25 03:43:38.987587 2025] [:error] [pid 61528:tid 61553] [client 20.10.155.243:2453] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-advaced.php"] [unique_id "aSS1apmXyiOE_lMDJTNG4gAAANc"]
[Tue Nov 25 03:43:41.455602 2025] [:error] [pid 61431:tid 61451] [client 20.10.155.243:4183] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wpc2.php"] [unique_id "aSS1bdISJUjxNuXBMNDBQgAAABA"]
[Tue Nov 25 03:43:43.634030 2025] [:error] [pid 61528:tid 61533] [client 20.10.155.243:2197] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wpc2.php"] [unique_id "aSS1b5mXyiOE_lMDJTNG7gAAAMM"]
[Tue Nov 25 03:43:48.193928 2025] [:error] [pid 61433:tid 61514] [client 20.10.155.243:4271] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wpc2.php"] [unique_id "aSS1dE1nb5r2eDXSMnS0uAAAAJE"]
[Tue Nov 25 03:43:50.324864 2025] [:error] [pid 61432:tid 61493] [client 20.10.155.243:2492] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wpc2.php"] [unique_id "aSS1dmjoHc8OYPguMSCunQAAAFc"]
[Tue Nov 25 03:43:51.951243 2025] [:error] [pid 61528:tid 61532] [client 20.10.155.243:6399] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/test1.php"] [unique_id "aSS1d5mXyiOE_lMDJTNHAgAAAMI"]
[Tue Nov 25 03:43:59.569381 2025] [:error] [pid 61431:tid 61443] [client 20.10.155.243:5727] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/test1.php"] [unique_id "aSS1f9ISJUjxNuXBMNDBXQAAAAg"]
[Tue Nov 25 03:44:00.396834 2025] [:error] [pid 61431:tid 61447] [client 20.10.155.243:6397] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/test1.php"] [unique_id "aSS1gNISJUjxNuXBMNDBXwAAAAw"]
[Tue Nov 25 03:44:13.481377 2025] [:error] [pid 61432:tid 61471] [client 20.10.155.243:5004] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/obfuscous.php"] [unique_id "aSS1jWjoHc8OYPguMSCuwwAAAEE"]
[Tue Nov 25 03:45:33.889213 2025] [:error] [pid 34694:tid 34714] [client 20.10.155.243:3318] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nonesoterically.php"] [unique_id "aSS13VBW7J9m3gnaVKSg9wAAAAY"]
[Tue Nov 25 03:45:37.594187 2025] [:error] [pid 34790:tid 34804] [client 20.10.155.243:2091] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nonesoterically.php"] [unique_id "aSS14b6t_aow_iQiQYAjPgAAAME"]
[Tue Nov 25 03:45:39.193884 2025] [:error] [pid 34790:tid 34820] [client 20.10.155.243:3556] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nonesoterically.php"] [unique_id "aSS1476t_aow_iQiQYAjQQAAANE"]
[Tue Nov 25 03:45:41.500750 2025] [:error] [pid 34694:tid 34718] [client 20.10.155.243:3295] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nonesoterically.php"] [unique_id "aSS15VBW7J9m3gnaVKSg-QAAAAo"]
[Tue Nov 25 03:45:44.849750 2025] [:error] [pid 34696:tid 34763] [client 20.10.155.243:2089] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/unprecipitously.php"] [unique_id "aSS16HZD4E4cFtkL0rW_8QAAAIA"]
[Tue Nov 25 03:45:47.647686 2025] [:error] [pid 34790:tid 34804] [client 20.10.155.243:2065] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/unprecipitously.php"] [unique_id "aSS1676t_aow_iQiQYAjSAAAAME"]
[Tue Nov 25 03:45:50.132226 2025] [:error] [pid 34790:tid 34823] [client 20.10.155.243:3859] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/unprecipitously.php"] [unique_id "aSS17r6t_aow_iQiQYAjTgAAANQ"]
[Tue Nov 25 03:45:52.129096 2025] [:error] [pid 34694:tid 34725] [client 20.10.155.243:6924] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/unprecipitously.php"] [unique_id "aSS18FBW7J9m3gnaVKShAQAAABE"]
[Tue Nov 25 03:45:57.315056 2025] [:error] [pid 34790:tid 34816] [client 20.10.155.243:6243] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/krypton.php"] [unique_id "aSS19b6t_aow_iQiQYAjVwAAAM0"]
[Tue Nov 25 03:46:03.587238 2025] [:error] [pid 34694:tid 34724] [client 20.10.155.243:3521] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/krypton.php"] [unique_id "aSS1-1BW7J9m3gnaVKShCgAAABA"]
[Tue Nov 25 03:46:07.001808 2025] [:error] [pid 34695:tid 34754] [client 20.10.155.243:1832] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/krypton.php"] [unique_id "aSS1_iwTx_MzUP3xQvkb6gAAAFI"]
[Tue Nov 25 03:46:09.111154 2025] [:error] [pid 34695:tid 34755] [client 20.10.155.243:3589] [client 20.10.155.243] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/krypton.php"] [unique_id "aSS2ASwTx_MzUP3xQvkb6wAAAFM"]
[Tue Nov 25 03:55:33.665832 2025] [:error] [pid 14168:tid 14176] [client 91.206.200.200:36882] [client 91.206.200.200] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.206.200.200, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSS4NfR-ZDU0QEgAIItM9AAAAMU"], referer: http://paramountestate.com.au
[Tue Nov 25 04:49:09.766241 2025] [:error] [pid 14168:tid 14171] [client 162.0.232.40:40440] [client 162.0.232.40] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.0.232.40, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSTExfR-ZDU0QEgAIIthqgAAAMA"], referer: http://paramountestate.com.au
[Tue Nov 25 05:03:16.787914 2025] [:error] [pid 14688:tid 14707] [client 63.250.38.185:50550] [client 63.250.38.185] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 63.250.38.185, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSTIFG9vYrBoEsiDnizcPgAAARE"], referer: http://paramountestate.com.au
[Tue Nov 25 05:26:31.497036 2025] [:error] [pid 14688:tid 14694] [client 104.248.45.30:53668] [client 104.248.45.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 104.248.45.30, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSTNh29vYrBoEsiDnizkkQAAAQQ"], referer: http://paramountestate.com.au
[Tue Nov 25 05:41:26.603364 2025] [:error] [pid 14688:tid 14693] [client 182.18.239.189:34756] [client 182.18.239.189] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.18.239.189, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSTRBm9vYrBoEsiDniznuAAAAQM"], referer: http://paramountestate.com.au
[Tue Nov 25 06:00:05.683373 2025] [:error] [pid 14168:tid 14183] [client 172.188.216.109:45590] [client 172.188.216.109] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 172.188.216.109, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSTVZfR-ZDU0QEgAIIt6dwAAAMw"], referer: http://paramountestate.com.au
[Tue Nov 25 06:41:17.233390 2025] [:error] [pid 14688:tid 14695] [client 192.241.128.246:49910] [client 192.241.128.246] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.241.128.246, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSTfDW9vYrBoEsiDniz4YgAAAQU"], referer: http://paramountestate.com.au
[Tue Nov 25 06:41:17.235695 2025] [:error] [pid 14688:tid 14695] [client 192.241.128.246:49910] [client 192.241.128.246] ModSecurity: XML parser error: XML: Failed parsing document. [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSTfDW9vYrBoEsiDniz4YgAAAQU"], referer: http://paramountestate.com.au
[Tue Nov 25 06:41:17.237079 2025] [:error] [pid 14688:tid 14695] [client 192.241.128.246:49910] [client 192.241.128.246] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||paramountestate.com.au|F|2"] [data "XML parser error: XML: Failed parsing document."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSTfDW9vYrBoEsiDniz4YgAAAQU"], referer: http://paramountestate.com.au
[Tue Nov 25 08:29:27.231713 2025] [:error] [pid 14077:tid 14116] [client 110.41.4.78:35192] [client 110.41.4.78] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 110.41.4.78, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aST4ZxG9n7UHEkwDTyiDVQAAAEY"], referer: http://paramountestate.com.au
[Tue Nov 25 10:52:27.415880 2025] [:error] [pid 28740:tid 28815] [client 84.46.240.206:52550] [client 84.46.240.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.46.240.206, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSUZ61ppQCoYxWW6V0X06wAAAlg"], referer: http://paramountestate.com.au
[Tue Nov 25 11:52:29.356254 2025] [:error] [pid 28836:tid 28967] [client 91.224.90.83:40270] [client 91.224.90.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.224.90.83, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSUn_ZwNRsoxcLQGkTdJvAAAAsw"], referer: http://paramountestate.com.au
[Tue Nov 25 12:50:53.621773 2025] [:error] [pid 14168:tid 14173] [client 106.51.171.116:56526] [client 106.51.171.116] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.171.116, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSU1rfR-ZDU0QEgAIIv4-AAAAMI"]
[Tue Nov 25 14:56:19.355707 2025] [:error] [pid 14078:tid 14138] [client 162.241.217.111:13172] [client 162.241.217.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.217.111, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSVTE9VXYbb0ii_rVoL2rwAAAIE"], referer: http://paramountestate.com.au
[Tue Nov 25 15:59:13.296628 2025] [:error] [pid 2987:tid 3005] [client 192.185.81.229:34108] [client 192.185.81.229] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 192.185.81.229, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSVh0c-djEt-pTzPxnxoBgAAAVA"], referer: http://paramountestate.com.au
[Tue Nov 25 17:00:17.609826 2025] [:error] [pid 14168:tid 14194] [client 103.31.38.163:53514] [client 103.31.38.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.31.38.163, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSVwIfR-ZDU0QEgAIItENQAAANc"], referer: http://paramountestate.com.au
[Tue Nov 25 17:05:13.614325 2025] [:error] [pid 14077:tid 14122] [client 161.35.31.101:64540] [client 161.35.31.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.31.101, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aSVxSRG9n7UHEkwDTyhOfgAAAEw"]
[Tue Nov 25 17:05:14.612880 2025] [:error] [pid 14077:tid 14133] [client 161.35.31.101:63096] [client 161.35.31.101] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 161.35.31.101, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aSVxShG9n7UHEkwDTyhOgQAAAFc"]
[Tue Nov 25 17:58:55.617896 2025] [:error] [pid 28740:tid 28796] [client 54.173.250.15:56796] [client 54.173.250.15] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aSV931ppQCoYxWW6V0ViCAAAAkU"]
[Tue Nov 25 18:53:16.618791 2025] [:error] [pid 2987:tid 3009] [client 138.199.60.187:56066] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless.php"] [unique_id "aSWKnM-djEt-pTzPxnyURQAAAVQ"]
[Tue Nov 25 18:53:16.850241 2025] [:error] [pid 14077:tid 14111] [client 138.199.60.187:56414] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless.php"] [unique_id "aSWKnBG9n7UHEkwDTyh-fgAAAEE"]
[Tue Nov 25 18:53:17.120174 2025] [:error] [pid 28740:tid 28807] [client 138.199.60.187:56712] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless.php"] [unique_id "aSWKnVppQCoYxWW6V0VzJAAAAlA"]
[Tue Nov 25 18:53:17.370171 2025] [:error] [pid 14076:tid 14093] [client 138.199.60.187:56948] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless.php"] [unique_id "aSWKnXsB4Gz6Qw-pvBsKgAAAAAw"]
[Tue Nov 25 18:53:17.643410 2025] [:error] [pid 28609:tid 28620] [client 138.199.60.187:57118] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless.php"] [unique_id "aSWKnSGGdT-nZJVs3x25IwAAAYI"]
[Tue Nov 25 18:53:17.914364 2025] [:error] [pid 28609:tid 28640] [client 138.199.60.187:53534] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnSGGdT-nZJVs3x25JAAAAZY"]
[Tue Nov 25 18:53:18.155687 2025] [:error] [pid 28739:tid 28780] [client 138.199.60.187:53596] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnhxGpKmlkG4FexRwkgAAAhI"]
[Tue Nov 25 18:53:18.406930 2025] [:error] [pid 28740:tid 28811] [client 138.199.60.187:53668] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnlppQCoYxWW6V0VzNAAAAlQ"]
[Tue Nov 25 18:53:18.681567 2025] [:error] [pid 2987:tid 3009] [client 138.199.60.187:53712] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKns-djEt-pTzPxnyUVQAAAVQ"]
[Tue Nov 25 18:53:18.932965 2025] [:error] [pid 28836:tid 29014] [client 138.199.60.187:53746] [client 138.199.60.187] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "aSWKnpwNRsoxcLQGkTe37QAAAtg"]
[Tue Nov 25 19:38:42.839129 2025] [:error] [pid 28740:tid 28803] [client 103.31.38.163:35488] [client 103.31.38.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.31.38.163, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSWVQlppQCoYxWW6V0WCnQAAAkw"], referer: http://paramountestate.com.au
[Tue Nov 25 22:59:53.360764 2025] [:error] [pid 14078:tid 14157] [client 20.36.171.210:65270] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "aSXEadVXYbb0ii_rVoKl9AAAAJQ"]
[Tue Nov 25 22:59:54.405298 2025] [:error] [pid 28609:tid 28632] [client 20.36.171.210:65253] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aSXEaiGGdT-nZJVs3x0HFgAAAY4"]
[Tue Nov 25 22:59:55.453472 2025] [:error] [pid 28739:tid 28771] [client 20.36.171.210:65241] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "aSXEaxxGpKmlkG4FexTKDwAAAgk"]
[Tue Nov 25 23:00:02.495461 2025] [:error] [pid 28609:tid 28634] [client 20.36.171.210:65173] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aSXEciGGdT-nZJVs3x0HHwAAAZA"]
[Tue Nov 25 23:00:25.565442 2025] [:error] [pid 14077:tid 14119] [client 20.36.171.210:65204] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "aSXEiRG9n7UHEkwDTyjk6wAAAEk"]
[Tue Nov 25 23:00:32.965883 2025] [:error] [pid 43843:tid 43867] [client 20.36.171.210:63976] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/admin.php"] [unique_id "aSXEkBhx4v3NUNdMKDMJswAAAdY"]
[Tue Nov 25 23:00:38.622387 2025] [:error] [pid 43981:tid 44007] [client 20.36.171.210:65230] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "aSXElggZn97m_qh_RaF-SgAAAxg"]
[Tue Nov 25 23:00:39.913252 2025] [:error] [pid 14168:tid 14190] [client 20.36.171.210:65179] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/google-seo-rank/index.php"] [unique_id "aSXEl_R-ZDU0QEgAIIujIwAAANM"]
[Tue Nov 25 23:00:41.225599 2025] [:error] [pid 14077:tid 14118] [client 20.36.171.210:65263] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/google-seo-rank/index.php"] [unique_id "aSXEmRG9n7UHEkwDTyjlBQAAAEg"]
[Tue Nov 25 23:00:42.346267 2025] [:error] [pid 14076:tid 14083] [client 20.36.171.210:65212] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/google-seo-rank/index.php"] [unique_id "aSXEmnsB4Gz6Qw-pvBtdVQAAAAI"]
[Tue Nov 25 23:00:43.447735 2025] [:error] [pid 28739:tid 28780] [client 20.36.171.210:65231] [client 20.36.171.210] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/google-seo-rank/index.php"] [unique_id "aSXEmxxGpKmlkG4FexTKPgAAAhI"]
[Tue Nov 25 23:00:44.845148 2025] [:error] [pid 14076:tid 14092] [client 20.36.171.210:63873] [client 20.36.171.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php/wp-content/plugins/google-seo-rank/index.php"] [unique_id "aSXEnHsB4Gz6Qw-pvBtdVwAAAAs"]
[Tue Nov 25 23:02:32.026152 2025] [:error] [pid 14077:tid 14110] [client 98.142.97.74:34086] [client 98.142.97.74] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 98.142.97.74, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXFCBG9n7UHEkwDTyjlogAAAEA"], referer: http://paramountestate.com.au
[Tue Nov 25 23:17:16.840337 2025] [:error] [pid 14077:tid 14112] [client 50.6.206.129:60118] [client 50.6.206.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.6.206.129, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXIfBG9n7UHEkwDTyjpBgAAAEI"], referer: http://paramountestate.com.au
[Tue Nov 25 23:24:23.675184 2025] [:error] [pid 14077:tid 14132] [client 78.111.87.202:47346] [client 78.111.87.202] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 78.111.87.202, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXKJxG9n7UHEkwDTyjrlgAAAFY"], referer: http://paramountestate.com.au
[Tue Nov 25 23:26:57.790865 2025] [:error] [pid 28739:tid 28784] [client 139.59.30.253:52622] [client 139.59.30.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/"] [unique_id "aSXKwRxGpKmlkG4FexTUXAAAAhY"], referer: binance.com
[Tue Nov 25 23:28:04.538861 2025] [:error] [pid 14076:tid 14084] [client 47.100.26.247:60854] [client 47.100.26.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.100.26.247, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXLBHsB4Gz6Qw-pvBtmBQAAAAM"], referer: http://paramountestate.com.au
[Tue Nov 25 23:48:46.675169 2025] [:error] [pid 14077:tid 14131] [client 160.187.38.101:47230] [client 160.187.38.101] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 160.187.38.101, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXP3hG9n7UHEkwDTyjxvwAAAFU"], referer: http://paramountestate.com.au
[Wed Nov 26 00:08:27.543364 2025] [:error] [pid 43981:tid 43992] [client 68.178.220.63:45498] [client 68.178.220.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 68.178.220.63, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXUewgZn97m_qh_RaGOTgAAAwk"], referer: http://paramountestate.com.au
[Wed Nov 26 00:41:20.282803 2025] [:error] [pid 28739:tid 28762] [client 84.200.205.222:36918] [client 84.200.205.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.200.205.222, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXcMBxGpKmlkG4FexTwEAAAAgA"], referer: http://paramountestate.com.au
[Wed Nov 26 01:04:54.514479 2025] [:error] [pid 28836:tid 28959] [client 91.206.200.156:41568] [client 91.206.200.156] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.206.200.156, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXhtpwNRsoxcLQGkTcfZgAAAsQ"], referer: http://paramountestate.com.au
[Wed Nov 26 01:11:13.351379 2025] [:error] [pid 14078:tid 14143] [client 152.42.202.97:45840] [client 152.42.202.97] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.42.202.97, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXjMdVXYbb0ii_rVoLlaAAAAIY"], referer: http://paramountestate.com.au
[Wed Nov 26 01:29:57.082078 2025] [:error] [pid 28739:tid 28771] [client 209.87.158.9:52193] [client 209.87.158.9] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.87.158.9, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXnlRxGpKmlkG4FexT_BgAAAgk"], referer: http://paramountestate.com.au
[Wed Nov 26 01:39:01.914373 2025] [:error] [pid 14076:tid 14103] [client 178.32.167.66:10364] [client 178.32.167.66] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 178.32.167.66, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXptXsB4Gz6Qw-pvBuJRAAAABY"], referer: http://paramountestate.com.au
[Wed Nov 26 01:52:41.182292 2025] [:error] [pid 14078:tid 14142] [client 36.50.177.91:54844] [client 36.50.177.91] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 36.50.177.91, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXs6dVXYbb0ii_rVoLzLwAAAIU"], referer: http://paramountestate.com.au
[Wed Nov 26 01:55:15.059378 2025] [:error] [pid 14168:tid 14182] [client 103.75.185.111:50632] [client 103.75.185.111] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.75.185.111, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXtg_R-ZDU0QEgAIIvHVgAAAMs"], referer: http://paramountestate.com.au
[Wed Nov 26 01:57:54.862659 2025] [:error] [pid 14076:tid 14101] [client 162.243.195.11:50128] [client 162.243.195.11] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.243.195.11, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSXuInsB4Gz6Qw-pvBuNcQAAABQ"], referer: http://paramountestate.com.au
[Wed Nov 26 02:35:17.827352 2025] [:error] [pid 14076:tid 14103] [client 5.182.33.212:48438] [client 5.182.33.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 5.182.33.212, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSX25XsB4Gz6Qw-pvBuV9AAAABY"], referer: http://paramountestate.com.au
[Wed Nov 26 02:47:55.052212 2025] [:error] [pid 43981:tid 43989] [client 47.76.140.35:56930] [client 47.76.140.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.76.140.35, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSX52wgZn97m_qh_RaGpPgAAAwY"], referer: http://paramountestate.com.au
[Wed Nov 26 02:50:16.580729 2025] [:error] [pid 43981:tid 43997] [client 107.20.228.107:8134] [client 107.20.228.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.20.228.107, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSX6aAgZn97m_qh_RaGpnwAAAw4"], referer: http://paramountestate.com.au
[Wed Nov 26 03:17:45.749251 2025] [:error] [pid 47044:tid 47080] [client 89.46.107.190:44422] [client 89.46.107.190] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.107.190, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYA2Zsj4UkzsEyBt5R31AAAABQ"], referer: http://paramountestate.com.au
[Wed Nov 26 03:20:23.008164 2025] [:error] [pid 47045:tid 47112] [client 54.190.10.234:45224] [client 54.190.10.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 54.190.10.234, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYBdxsL_waSUMFH0J74bgAAAFg"], referer: http://paramountestate.com.au
[Wed Nov 26 03:24:02.795716 2025] [autoindex:error] [pid 19661:tid 19688] [client 20.122.102.63:6263] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.google.de/
[Wed Nov 26 03:26:05.425682 2025] [:error] [pid 19664:tid 19730] [client 45.61.185.56:58056] [client 45.61.185.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.185.56, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aSYCzYHU6yUQwaQ4jb1nZwAAAIo"]
[Wed Nov 26 03:30:18.220887 2025] [:error] [pid 50570:tid 50591] [client 107.180.116.5:62532] [client 107.180.116.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.180.116.5, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYDyhPvlpMXl6UAqyu-GAAAAAw"], referer: http://paramountestate.com.au
[Wed Nov 26 03:30:19.941343 2025] [:error] [pid 50667:tid 50677] [client 45.61.185.56:14493] [client 45.61.185.56] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.61.185.56, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aSYDy7YzKSjU9X7NQW-7SwAAAMQ"]
[Wed Nov 26 03:35:06.787815 2025] [:error] [pid 50667:tid 50673] [client 162.241.244.141:34434] [client 162.241.244.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 162.241.244.141, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYE6rYzKSjU9X7NQW-9DAAAAMA"], referer: http://paramountestate.com.au
[Wed Nov 26 03:39:48.990501 2025] [:error] [pid 23968:tid 23999] [client 84.200.205.222:40842] [client 84.200.205.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.200.205.222, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYGBM4ofN5EjQSFyQcUwgAAAAs"], referer: http://paramountestate.com.au
[Wed Nov 26 03:46:54.393945 2025] [:error] [pid 3493:tid 3507] [client 185.23.69.233:46282] [client 185.23.69.233] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 185.23.69.233, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYHrmBUa93ugXko11NJcAAAAQw"], referer: http://paramountestate.com.au
[Wed Nov 26 03:49:17.841399 2025] [:error] [pid 3010:tid 3028] [client 136.243.160.8:50068] [client 136.243.160.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 136.243.160.8, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYIPUWl16-roARWvItGagAAAA4"], referer: http://paramountestate.com.au
[Wed Nov 26 03:51:48.078083 2025] [:error] [pid 3493:tid 3506] [client 45.48.131.81:52330] [client 45.48.131.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.48.131.81, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYI1GBUa93ugXko11NLfAAAAQs"], referer: http://paramountestate.com.au
[Wed Nov 26 03:54:05.908189 2025] [:error] [pid 3493:tid 3500] [client 89.46.107.119:24306] [client 89.46.107.119] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 89.46.107.119, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYJXWBUa93ugXko11NM7gAAAQU"], referer: http://paramountestate.com.au
[Wed Nov 26 04:06:18.489805 2025] [:error] [pid 3012:tid 3088] [client 148.251.123.155:60160] [client 148.251.123.155] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 148.251.123.155, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYMOkfo8Sm1Un9NK6gaHgAAAJM"], referer: http://paramountestate.com.au
[Wed Nov 26 04:08:50.432047 2025] [:error] [pid 3493:tid 3516] [client 3.94.27.7:52966] [client 3.94.27.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.94.27.7, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYM0mBUa93ugXko11NUzAAAARU"], referer: http://paramountestate.com.au
[Wed Nov 26 04:11:54.587753 2025] [:error] [pid 38796:tid 38822] [client 3.94.27.7:36514] [client 3.94.27.7] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 3.94.27.7, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYNigGcUUzaXxvjCXOS0AAAAVc"], referer: http://paramountestate.com.au
[Wed Nov 26 04:14:24.193751 2025] [:error] [pid 3010:tid 3027] [client 107.20.228.107:22122] [client 107.20.228.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 107.20.228.107, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYOIEWl16-roARWvItN_wAAAA0"], referer: http://paramountestate.com.au
[Wed Nov 26 04:40:02.291227 2025] [:error] [pid 3011:tid 3060] [client 81.177.139.64:56478] [client 81.177.139.64] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 81.177.139.64, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYUIkb0BA3GljiGlI6y8wAAAFI"], referer: http://paramountestate.com.au
[Wed Nov 26 04:55:29.857793 2025] [:error] [pid 3012:tid 3084] [client 47.100.26.247:45074] [client 47.100.26.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.100.26.247, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYXwUfo8Sm1Un9NK6goIAAAAI8"], referer: http://paramountestate.com.au
[Wed Nov 26 04:57:56.436017 2025] [:error] [pid 3011:tid 3048] [client 47.76.140.35:46008] [client 47.76.140.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 47.76.140.35, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYYVEb0BA3GljiGlI64pQAAAEY"], referer: http://paramountestate.com.au
[Wed Nov 26 05:01:27.589216 2025] [:error] [pid 3012:tid 3069] [client 65.111.2.42:28405] [client 65.111.2.42] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "aSYZJ0fo8Sm1Un9NK6gpsgAAAIA"]
[Wed Nov 26 05:01:30.756283 2025] [:error] [pid 3097:tid 3102] [client 104.207.49.247:38677] [client 104.207.49.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aSYZKuVgdOH9N9jhT56HgwAAAME"]
[Wed Nov 26 05:01:31.742922 2025] [:error] [pid 3012:tid 3073] [client 209.50.187.220:44275] [client 209.50.187.220] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.svn/wc.db"] [unique_id "aSYZK0fo8Sm1Un9NK6gpugAAAIQ"]
[Wed Nov 26 05:03:00.761468 2025] [:error] [pid 3097:tid 3120] [client 134.122.30.120:36228] [client 134.122.30.120] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 134.122.30.120, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYZhOVgdOH9N9jhT56IKQAAANM"], referer: http://paramountestate.com.au
[Wed Nov 26 05:10:37.011383 2025] [:error] [pid 3493:tid 3496] [client 66.63.182.206:37782] [client 66.63.182.206] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 66.63.182.206, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYbTWBUa93ugXko11NpsAAAAQE"], referer: http://paramountestate.com.au
[Wed Nov 26 05:15:45.058185 2025] [:error] [pid 3493:tid 3495] [client 154.38.168.73:60164] [client 154.38.168.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 154.38.168.73, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aSYcgWBUa93ugXko11NregAAAQA"], referer: http://paramountestate.com.au
[Wed Nov 26 07:25:12.544064 2025] [:error] [pid 34743:tid 34787] [client 213.21.239.4:54184] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/config"] [unique_id "aSY62AvyX7Q5oU7_mBxGYgAAAUs"]
[Wed Nov 26 07:25:12.547433 2025] [:error] [pid 34744:tid 34815] [client 213.21.239.4:54190] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/developer/.git/config"] [unique_id "aSY62EtgOvVbhyALkTSVXgAAAYw"]
[Wed Nov 26 07:25:12.547441 2025] [:error] [pid 34830:tid 34835] [client 213.21.239.4:54210] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/common/.git/config"] [unique_id "aSY62EukvkWgWN6jCR1P1wAAAAM"]
[Wed Nov 26 07:25:12.550371 2025] [:error] [pid 34830:tid 34838] [client 213.21.239.4:54312] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate/.git;/config"] [unique_id "aSY62EukvkWgWN6jCR1P2AAAAAY"]
[Wed Nov 26 07:25:12.552592 2025] [:error] [pid 34744:tid 34812] [client 213.21.239.4:54176] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/api/.git/config"] [unique_id "aSY62EtgOvVbhyALkTSVXwAAAYk"]
[Wed Nov 26 07:25:12.552994 2025] [:error] [pid 34743:tid 34782] [client 213.21.239.4:54254] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/dev/.git/config"] [unique_id "aSY62AvyX7Q5oU7_mBxGYwAAAUY"]
[Wed Nov 26 07:25:12.557952 2025] [:error] [pid 34744:tid 34807] [client 213.21.239.4:54282] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/css../.git/config"] [unique_id "aSY62EtgOvVbhyALkTSVYAAAAYQ"]
[Wed Nov 26 07:25:12.558479 2025] [:error] [pid 34830:tid 34853] [client 213.21.239.4:54216] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/database/.git/config"] [unique_id "aSY62EukvkWgWN6jCR1P2QAAABU"]
[Wed Nov 26 07:25:12.558795 2025] [:error] [pid 34830:tid 34851] [client 213.21.239.4:54098] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate/config"] [unique_id "aSY62EukvkWgWN6jCR1P2gAAABM"]
[Wed Nov 26 07:25:12.558929 2025] [:error] [pid 34830:tid 34841] [client 213.21.239.4:54218] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/application/.git/config"] [unique_id "aSY62EukvkWgWN6jCR1P2wAAAAk"]
[Wed Nov 26 07:25:12.561108 2025] [:error] [pid 34743:tid 34786] [client 213.21.239.4:54280] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/assets../.git/config"] [unique_id "aSY62AvyX7Q5oU7_mBxGZAAAAUo"]
[Wed Nov 26 07:25:12.563170 2025] [:error] [pid 34743:tid 34791] [client 213.21.239.4:54124] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/admin/.git/config"] [unique_id "aSY62AvyX7Q5oU7_mBxGZQAAAU8"]
[Wed Nov 26 07:25:12.563492 2025] [:error] [pid 35540:tid 35560] [client 213.21.239.4:54126] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate../config"] [unique_id "aSY62MGrIq2A6SZSnkLtgwAAAI4"]
[Wed Nov 26 07:25:12.563660 2025] [:error] [pid 34830:tid 34836] [client 213.21.239.4:54142] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au../config"] [unique_id "aSY62EukvkWgWN6jCR1P3AAAAAQ"]
[Wed Nov 26 07:25:12.567162 2025] [:error] [pid 34743:tid 34800] [client 213.21.239.4:54298] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate/static../.git/config"] [unique_id "aSY62AvyX7Q5oU7_mBxGZgAAAVg"]
[Wed Nov 26 07:25:12.567446 2025] [:error] [pid 34830:tid 34832] [client 213.21.239.4:54238] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate../.git/config"] [unique_id "aSY62EukvkWgWN6jCR1P3gAAAAA"]
[Wed Nov 26 07:25:12.567663 2025] [:error] [pid 34830:tid 34834] [client 213.21.239.4:54192] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate/.git/%0Aconfig"] [unique_id "aSY62EukvkWgWN6jCR1P3QAAAAI"]
[Wed Nov 26 07:25:12.568452 2025] [:error] [pid 34830:tid 34840] [client 213.21.239.4:54152] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/content../.git/config"] [unique_id "aSY62EukvkWgWN6jCR1P3wAAAAg"]
[Wed Nov 26 07:25:12.570889 2025] [:error] [pid 34743:tid 34799] [client 213.21.239.4:54206] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate/.git/config;"] [unique_id "aSY62AvyX7Q5oU7_mBxGZwAAAVc"]
[Wed Nov 26 07:25:12.574349 2025] [:error] [pid 34830:tid 34839] [client 213.21.239.4:54268] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/app/.git/config"] [unique_id "aSY62EukvkWgWN6jCR1P4AAAAAc"]
[Wed Nov 26 07:25:12.575768 2025] [:error] [pid 34744:tid 34827] [client 213.21.239.4:54288] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate/.git/config;.."] [unique_id "aSY62EtgOvVbhyALkTSVYQAAAZg"]
[Wed Nov 26 07:25:12.577167 2025] [:error] [pid 34830:tid 34837] [client 213.21.239.4:54114] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate/;/.git/config"] [unique_id "aSY62EukvkWgWN6jCR1P4QAAAAU"]
[Wed Nov 26 07:25:12.577454 2025] [:error] [pid 34744:tid 34825] [client 213.21.239.4:54328] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate/.git/config"] [unique_id "aSY62EtgOvVbhyALkTSVYgAAAZY"]
[Wed Nov 26 07:25:12.577478 2025] [:error] [pid 34742:tid 34748] [client 213.21.239.4:54202] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/backup/.git/config"] [unique_id "aSY62JSuLNwpQF_jzAfvUAAAAEA"]
[Wed Nov 26 07:25:12.579635 2025] [:error] [pid 34743:tid 34798] [client 213.21.239.4:54164] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate/..;/.git/config"] [unique_id "aSY62AvyX7Q5oU7_mBxGaAAAAVY"]
[Wed Nov 26 07:25:14.570430 2025] [:error] [pid 34744:tid 34823] [client 213.21.239.4:54668] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate/.git;/config"] [unique_id "aSY62ktgOvVbhyALkTSVcwAAAZQ"]
[Wed Nov 26 07:25:14.572731 2025] [:error] [pid 34744:tid 34826] [client 213.21.239.4:54688] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate../config"] [unique_id "aSY62ktgOvVbhyALkTSVdAAAAZc"]
[Wed Nov 26 07:25:14.572960 2025] [:error] [pid 34742:tid 34761] [client 213.21.239.4:54658] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/config"] [unique_id "aSY62pSuLNwpQF_jzAfvVwAAAE0"]
[Wed Nov 26 07:25:14.583793 2025] [:error] [pid 35540:tid 35552] [client 213.21.239.4:54678] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate/config"] [unique_id "aSY62sGrIq2A6SZSnkLtiQAAAIY"]
[Wed Nov 26 07:25:14.596129 2025] [:error] [pid 35540:tid 35553] [client 213.21.239.4:54704] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au../config"] [unique_id "aSY62sGrIq2A6SZSnkLtigAAAIc"]
[Wed Nov 26 07:25:15.005651 2025] [:error] [pid 34744:tid 34811] [client 213.21.239.4:55080] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/..;/.git/config"] [unique_id "aSY620tgOvVbhyALkTSVgwAAAYg"]
[Wed Nov 26 07:25:15.008979 2025] [:error] [pid 34744:tid 34819] [client 213.21.239.4:55104] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config;"] [unique_id "aSY620tgOvVbhyALkTSVhQAAAZA"]
[Wed Nov 26 07:25:15.014528 2025] [:error] [pid 34830:tid 34834] [client 213.21.239.4:55054] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git;/config"] [unique_id "aSY620ukvkWgWN6jCR1P8gAAAAI"]
[Wed Nov 26 07:25:15.015134 2025] [:error] [pid 34744:tid 34805] [client 213.21.239.4:55192] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au../.git/config"] [unique_id "aSY620tgOvVbhyALkTSVhwAAAYI"]
[Wed Nov 26 07:25:15.016717 2025] [:error] [pid 34744:tid 34806] [client 213.21.239.4:55064] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/static../.git/config"] [unique_id "aSY620tgOvVbhyALkTSViAAAAYM"]
[Wed Nov 26 07:25:15.020108 2025] [:error] [pid 34744:tid 34827] [client 213.21.239.4:55068] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/%0Aconfig"] [unique_id "aSY620tgOvVbhyALkTSViQAAAZg"]
[Wed Nov 26 07:25:15.021221 2025] [:error] [pid 34743:tid 34777] [client 213.21.239.4:55220] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git/config"] [unique_id "aSY62wvyX7Q5oU7_mBxGdAAAAUE"]
[Wed Nov 26 07:25:15.022641 2025] [:error] [pid 34744:tid 34803] [client 213.21.239.4:55090] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aSY620tgOvVbhyALkTSVigAAAYA"]
[Wed Nov 26 07:25:15.027361 2025] [:error] [pid 34742:tid 34748] [client 213.21.239.4:55186] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git/%0Aconfig"] [unique_id "aSY625SuLNwpQF_jzAfvXgAAAEA"]
[Wed Nov 26 07:25:15.027656 2025] [:error] [pid 34743:tid 34776] [client 213.21.239.4:55142] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.git;/config;"] [unique_id "aSY62wvyX7Q5oU7_mBxGdQAAAUA"]
[Wed Nov 26 07:25:15.028171 2025] [:error] [pid 34743:tid 34781] [client 213.21.239.4:55170] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/images../.git/config"] [unique_id "aSY62wvyX7Q5oU7_mBxGdgAAAUU"]
[Wed Nov 26 07:25:15.028899 2025] [:error] [pid 35540:tid 35566] [client 213.21.239.4:55256] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/;/.git/config"] [unique_id "aSY628GrIq2A6SZSnkLtlAAAAJQ"]
[Wed Nov 26 07:25:15.030974 2025] [:error] [pid 34743:tid 34788] [client 213.21.239.4:55158] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/git/.git/config"] [unique_id "aSY62wvyX7Q5oU7_mBxGdwAAAUw"]
[Wed Nov 26 07:25:15.033352 2025] [:error] [pid 34743:tid 34793] [client 213.21.239.4:55208] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/..;/.git/config"] [unique_id "aSY62wvyX7Q5oU7_mBxGeAAAAVE"]
[Wed Nov 26 07:25:15.033436 2025] [:error] [pid 34743:tid 34792] [client 213.21.239.4:55154] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/;/.git/config"] [unique_id "aSY62wvyX7Q5oU7_mBxGeQAAAVA"]
[Wed Nov 26 07:25:15.039180 2025] [:error] [pid 35540:tid 35565] [client 213.21.239.4:55120] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config;.."] [unique_id "aSY628GrIq2A6SZSnkLtlQAAAJM"]
[Wed Nov 26 07:25:15.039348 2025] [:error] [pid 34743:tid 34790] [client 213.21.239.4:55232] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git/config;"] [unique_id "aSY62wvyX7Q5oU7_mBxGegAAAU4"]
[Wed Nov 26 07:25:15.043101 2025] [:error] [pid 34743:tid 34789] [client 213.21.239.4:55182] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/img../.git/config"] [unique_id "aSY62wvyX7Q5oU7_mBxGewAAAU0"]
[Wed Nov 26 07:25:15.043629 2025] [:error] [pid 34830:tid 34839] [client 213.21.239.4:55126] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.git;/config"] [unique_id "aSY620ukvkWgWN6jCR1P8wAAAAc"]
[Wed Nov 26 07:25:15.050280 2025] [:error] [pid 34830:tid 34850] [client 213.21.239.4:55246] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git/config;.."] [unique_id "aSY620ukvkWgWN6jCR1P9gAAABI"]
[Wed Nov 26 07:25:16.996861 2025] [:error] [pid 34830:tid 34841] [client 213.21.239.4:55540] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/m/.git/config"] [unique_id "aSY63EukvkWgWN6jCR1P_QAAAAk"]
[Wed Nov 26 07:25:17.023969 2025] [:error] [pid 34742:tid 34751] [client 213.21.239.4:55634] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/live/.git/config"] [unique_id "aSY63ZSuLNwpQF_jzAfveAAAAEM"]
[Wed Nov 26 07:25:17.024590 2025] [:error] [pid 34742:tid 34752] [client 213.21.239.4:55626] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/lib../.git/config"] [unique_id "aSY63ZSuLNwpQF_jzAfveQAAAEQ"]
[Wed Nov 26 07:25:17.033057 2025] [:error] [pid 34744:tid 34823] [client 213.21.239.4:55598] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/js../.git/config"] [unique_id "aSY63UtgOvVbhyALkTSVkQAAAZQ"]
[Wed Nov 26 07:25:17.033246 2025] [:error] [pid 34744:tid 34816] [client 213.21.239.4:55594] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/message-api/.git/config"] [unique_id "aSY63UtgOvVbhyALkTSVkgAAAY0"]
[Wed Nov 26 07:25:17.044694 2025] [:error] [pid 34743:tid 34790] [client 213.21.239.4:55714] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git;/config"] [unique_id "aSY63QvyX7Q5oU7_mBxGfwAAAU4"]
[Wed Nov 26 07:25:17.049166 2025] [:error] [pid 34742:tid 34771] [client 213.21.239.4:55718] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.git;/config;"] [unique_id "aSY63ZSuLNwpQF_jzAfvewAAAFc"]
[Wed Nov 26 07:25:17.072176 2025] [:error] [pid 34742:tid 34757] [client 213.21.239.4:55750] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.git;/config"] [unique_id "aSY63ZSuLNwpQF_jzAfvfwAAAEk"]
[Wed Nov 26 07:25:18.006751 2025] [:error] [pid 34830:tid 34844] [client 213.21.239.4:56012] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au../.git/config"] [unique_id "aSY63kukvkWgWN6jCR1P_wAAAAw"]
[Wed Nov 26 07:25:18.007683 2025] [:error] [pid 34744:tid 34818] [client 213.21.239.4:55946] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git/config;"] [unique_id "aSY63ktgOvVbhyALkTSVlgAAAY8"]
[Wed Nov 26 07:25:18.012732 2025] [:error] [pid 34830:tid 34840] [client 213.21.239.4:55906] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/new/.git/config"] [unique_id "aSY63kukvkWgWN6jCR1QAAAAAAg"]
[Wed Nov 26 07:25:18.013285 2025] [:error] [pid 34743:tid 34782] [client 213.21.239.4:55926] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/prod/.git/config"] [unique_id "aSY63gvyX7Q5oU7_mBxGiAAAAUY"]
[Wed Nov 26 07:25:18.013285 2025] [:error] [pid 34830:tid 34849] [client 213.21.239.4:56036] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/../config"] [unique_id "aSY63kukvkWgWN6jCR1QAQAAABE"]
[Wed Nov 26 07:25:18.017739 2025] [:error] [pid 34830:tid 34833] [client 213.21.239.4:55938] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/qa/.git/config"] [unique_id "aSY63kukvkWgWN6jCR1QAgAAAAE"]
[Wed Nov 26 07:25:18.019775 2025] [:error] [pid 34830:tid 34854] [client 213.21.239.4:56038] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/static../.git/config"] [unique_id "aSY63kukvkWgWN6jCR1QAwAAABY"]
[Wed Nov 26 07:25:18.021846 2025] [:error] [pid 34743:tid 34795] [client 213.21.239.4:55978] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git/config;.."] [unique_id "aSY63gvyX7Q5oU7_mBxGiQAAAVM"]
[Wed Nov 26 07:25:18.027511 2025] [:error] [pid 34743:tid 34784] [client 213.21.239.4:55914] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/config"] [unique_id "aSY63gvyX7Q5oU7_mBxGiwAAAUg"]
[Wed Nov 26 07:25:18.028383 2025] [:error] [pid 34742:tid 34758] [client 213.21.239.4:55998] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git;/config"] [unique_id "aSY63pSuLNwpQF_jzAfvhwAAAEo"]
[Wed Nov 26 07:25:18.029417 2025] [:error] [pid 34744:tid 34811] [client 213.21.239.4:55960] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au../config"] [unique_id "aSY63ktgOvVbhyALkTSVmAAAAYg"]
[Wed Nov 26 07:25:18.030823 2025] [:error] [pid 34743:tid 34799] [client 213.21.239.4:56056] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git/config"] [unique_id "aSY63gvyX7Q5oU7_mBxGjAAAAVc"]
[Wed Nov 26 07:25:18.034392 2025] [:error] [pid 34742:tid 34755] [client 213.21.239.4:55966] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/config"] [unique_id "aSY63pSuLNwpQF_jzAfviAAAAEc"]
[Wed Nov 26 07:25:18.034483 2025] [:error] [pid 34742:tid 34760] [client 213.21.239.4:55988] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git/%0Aconfig"] [unique_id "aSY63pSuLNwpQF_jzAfviQAAAEw"]
[Wed Nov 26 07:25:18.036871 2025] [:error] [pid 34830:tid 34848] [client 213.21.239.4:56028] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/;/.git/config"] [unique_id "aSY63kukvkWgWN6jCR1QBAAAABA"]
[Wed Nov 26 07:25:18.039086 2025] [:error] [pid 34744:tid 34804] [client 213.21.239.4:56054] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/..;/.git/config"] [unique_id "aSY63ktgOvVbhyALkTSVmQAAAYE"]
[Wed Nov 26 07:25:18.040009 2025] [:error] [pid 34743:tid 34798] [client 213.21.239.4:56052] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/public/.git/config"] [unique_id "aSY63gvyX7Q5oU7_mBxGjQAAAVY"]
[Wed Nov 26 07:25:19.998296 2025] [:error] [pid 34830:tid 34850] [client 213.21.239.4:56240] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aSY630ukvkWgWN6jCR1QCQAAABI"]
[Wed Nov 26 07:25:20.000676 2025] [:error] [pid 34830:tid 34844] [client 213.21.239.4:56246] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config;.."] [unique_id "aSY64EukvkWgWN6jCR1QCwAAAAw"]
[Wed Nov 26 07:25:20.002460 2025] [:error] [pid 35540:tid 35561] [client 213.21.239.4:56164] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/..;/.git/config"] [unique_id "aSY64MGrIq2A6SZSnkLtmQAAAI8"]
[Wed Nov 26 07:25:20.005981 2025] [:error] [pid 34742:tid 34757] [client 213.21.239.4:56154] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/../.git/config"] [unique_id "aSY64JSuLNwpQF_jzAfvkQAAAEk"]
[Wed Nov 26 07:25:20.006202 2025] [:error] [pid 34744:tid 34814] [client 213.21.239.4:56182] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config;"] [unique_id "aSY64EtgOvVbhyALkTSVmwAAAYs"]
[Wed Nov 26 07:25:20.015014 2025] [:error] [pid 34743:tid 34780] [client 213.21.239.4:56146] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/%0Aconfig"] [unique_id "aSY64AvyX7Q5oU7_mBxGkgAAAUQ"]
[Wed Nov 26 07:25:20.016053 2025] [:error] [pid 34830:tid 34833] [client 213.21.239.4:56254] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.git;/config"] [unique_id "aSY64EukvkWgWN6jCR1QDQAAAAE"]
[Wed Nov 26 07:25:20.018539 2025] [:error] [pid 34830:tid 34849] [client 213.21.239.4:56200] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/;/.git/config"] [unique_id "aSY64EukvkWgWN6jCR1QDgAAABE"]
[Wed Nov 26 07:25:20.061194 2025] [:error] [pid 34743:tid 34777] [client 213.21.239.4:56312] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/config"] [unique_id "aSY64AvyX7Q5oU7_mBxGkwAAAUE"]
[Wed Nov 26 07:25:20.061762 2025] [:error] [pid 34742:tid 34768] [client 213.21.239.4:56274] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au../config"] [unique_id "aSY64JSuLNwpQF_jzAfvlgAAAFQ"]
[Wed Nov 26 07:25:20.062625 2025] [:error] [pid 34742:tid 34763] [client 213.21.239.4:56314] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/.git;/config"] [unique_id "aSY64JSuLNwpQF_jzAfvlwAAAE8"]
[Wed Nov 26 07:25:20.066121 2025] [:error] [pid 34744:tid 34810] [client 213.21.239.4:56322] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/paramountestate.com.au/config"] [unique_id "aSY64EtgOvVbhyALkTSVnAAAAYc"]
[Wed Nov 26 07:25:20.066511 2025] [:error] [pid 34742:tid 34765] [client 213.21.239.4:56288] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/../config"] [unique_id "aSY64JSuLNwpQF_jzAfvmQAAAFE"]
[Wed Nov 26 07:25:20.996629 2025] [:error] [pid 34742:tid 34764] [client 213.21.239.4:56374] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/staging/.git/config"] [unique_id "aSY64JSuLNwpQF_jzAfvmwAAAFA"]
[Wed Nov 26 07:25:20.997795 2025] [:error] [pid 34743:tid 34787] [client 213.21.239.4:56438] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/web/.git/config"] [unique_id "aSY64AvyX7Q5oU7_mBxGlgAAAUs"]
[Wed Nov 26 07:25:20.999853 2025] [:error] [pid 34743:tid 34791] [client 213.21.239.4:56414] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/.git/config"] [unique_id "aSY64AvyX7Q5oU7_mBxGlwAAAU8"]
[Wed Nov 26 07:25:21.005769 2025] [:error] [pid 34743:tid 34800] [client 213.21.239.4:56400] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/static../.git/config"] [unique_id "aSY64QvyX7Q5oU7_mBxGmQAAAVg"]
[Wed Nov 26 07:25:21.011478 2025] [:error] [pid 34742:tid 34748] [client 213.21.239.4:56366] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/static../.git/config"] [unique_id "aSY64ZSuLNwpQF_jzAfvnAAAAEA"]
[Wed Nov 26 07:25:21.013455 2025] [:error] [pid 34743:tid 34782] [client 213.21.239.4:56334] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/.git/config"] [unique_id "aSY64QvyX7Q5oU7_mBxGmgAAAUY"]
[Wed Nov 26 07:25:21.020119 2025] [:error] [pid 34744:tid 34808] [client 213.21.239.4:56420] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/uat/.git/config"] [unique_id "aSY64UtgOvVbhyALkTSVowAAAYU"]
[Wed Nov 26 07:25:21.026324 2025] [:error] [pid 34743:tid 34784] [client 213.21.239.4:56470] [client 213.21.239.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/.git/config"] [unique_id "aSY64QvyX7Q5oU7_mBxGnAAAAUg"]
[Wed Nov 26 07:25:22.058724 2025] [:error] [pid 34830:tid 34832] [client 213.21.239.4:36362] [client 213.21.239.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.git;/config"] [unique_id "aSY64kukvkWgWN6jCR1QEQAAAAA"]
[Wed Nov 26 13:56:58.333927 2025] [:error] [pid 35540:tid 35549] [client 139.59.30.253:63175] [client 139.59.30.253] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/"] [unique_id "aSaWqsGrIq2A6SZSnkJ_VQAAAIM"], referer: binance.com
[Wed Nov 26 23:08:14.069344 2025] [:error] [pid 45684:tid 45726] [client 216.126.239.203:35550] [client 216.126.239.203] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aScX3vg5LMxwI4-PD1epkAAAAAs"]
[Thu Nov 27 00:54:52.927566 2025] [:error] [pid 24826:tid 25118] [client 103.77.107.57:56129] [client 103.77.107.57] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "aScw3FEvPXLVl-nh-yLc3AAAAQM"]
[Thu Nov 27 00:54:53.189610 2025] [:error] [pid 8184:tid 8252] [client 103.77.107.57:55695] [client 103.77.107.57] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aScw3b-M2IHkRYVrcbN7PgAAAE4"]
[Thu Nov 27 03:45:46.753636 2025] [autoindex:error] [pid 26792:tid 26817] [client 20.19.177.7:57915] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive, referer: https://www.bing.com/
[Thu Nov 27 03:45:47.001480 2025] [proxy_fcgi:error] [pid 26792:tid 26812] [client 20.19.177.7:57915] AH01071: Got error 'Primary script unknown', referer: https://duckduckgo.com/
[Thu Nov 27 03:49:17.695242 2025] [:error] [pid 26898:tid 26909] [client 20.19.177.7:61359] [client 20.19.177.7] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aSdZvQgA4tSHKsSYspCX8QAAAMQ"], referer: https://www.google.de/
[Thu Nov 27 09:00:13.770726 2025] [authz_core:error] [pid 39563:tid 39576] [client 157.245.113.227:49520] AH01630: client denied by server configuration: /home/paramount/public_html/server-status
[Thu Nov 27 09:00:15.460610 2025] [:error] [pid 40009:tid 40071] [client 157.245.113.227:49556] [client 157.245.113.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aSein0JuxjShta_KR6UCGAAAAUg"]
[Thu Nov 27 09:00:15.877160 2025] [:error] [pid 19119:tid 19182] [client 157.245.113.227:49564] [client 157.245.113.227] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aSeinxsL_RTusriYkweCkgAAAMg"]
[Thu Nov 27 09:00:20.154036 2025] [authz_core:error] [pid 19015:tid 19073] [client 143.110.213.72:59420] AH01630: client denied by server configuration: /home/paramount/public_html/server-status
[Thu Nov 27 09:00:22.779771 2025] [:error] [pid 19014:tid 19048] [client 143.110.213.72:59446] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aSeipo2utvwZ4eADRmr-YAAAAEQ"]
[Thu Nov 27 09:00:23.432434 2025] [:error] [pid 19014:tid 19067] [client 143.110.213.72:59462] [client 143.110.213.72] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aSeip42utvwZ4eADRmr-ZgAAAFc"]
2026/03/10 22:46:03 [error] 3847#3847: *209916 access forbidden by rule, client: 62.164.177.15, server: paramountestate.com.au, request: "GET /.svn/wc.db HTTP/1.1", host: "paramountestate.com.au"
[Wed Mar 11 05:01:07.144185 2026] [:error] [pid 6222:tid 6224] [client 79.127.155.174:54742] [client 79.127.155.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-json/wc/store/v1/cart"] [unique_id "abCGk3s7MIv-0SYBFu1y0wAAAMA"]
2026/03/11 05:01:07 [error] 3461#3461: *474601 upstream prematurely closed connection while reading response header from upstream, client: 79.127.155.174, server: paramountestate.com.au, request: "GET /wp-json/wc/store/v1/cart HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-json/wc/store/v1/cart", host: "paramountestate.com.au"
2026/03/11 05:01:07 [error] 3468#3468: *474611 upstream prematurely closed connection while reading response header from upstream, client: 79.127.155.174, server: paramountestate.com.au, request: "GET /wp-json/wc/store/v1/payment_methods HTTP/1.1", upstream: "http://103.4.122.14:8181/wp-json/wc/store/v1/payment_methods", host: "paramountestate.com.au"
[Wed Mar 11 05:01:07.731078 2026] [:error] [pid 6117:tid 6147] [client 79.127.155.174:54754] [client 79.127.155.174] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-json/wc/store/v1/payment_methods"] [unique_id "abCGk8U0P9gyi5rKFp6RLQAAAAs"]
[Wed Mar 11 07:48:36.209607 2026] [:error] [pid 11796:tid 11803] [client 209.87.169.118:40384] [client 209.87.169.118] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abCt1AEDXoQrlStpO9AhWQAAAYU"]
[Wed Mar 11 12:25:50.543755 2026] [:error] [pid 23512:tid 23532] [client 37.251.16.163:39340] [client 37.251.16.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abDuzqeuPtNfm7KRzWW21AAAAVE"]
[Wed Mar 11 13:09:30.865557 2026] [:error] [pid 54045:tid 54064] [client 62.36.115.224:48804] [client 62.36.115.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abD5CiRcKzQ1f-N8TgQ8ZQAAANE"]
2026/03/11 17:36:56 [error] 53938#53938: *946388 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "GET / HTTP/1.1", upstream: "http://103.4.122.14:8181/", host: "paramountestate.com.au"
[Wed Mar 11 17:36:56.174735 2026] [:error] [pid 44995:tid 45013] [client 209.38.31.95:40508] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "abE3uDoOSr9ks_axo6ORhgAAAlA"]
[Wed Mar 11 17:36:56.190604 2026] [:error] [pid 53955:tid 54029] [client 209.38.31.95:40510] [client 209.38.31.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "abE3uNP1Uf6qBkbxZg_l7AAAAIo"]
2026/03/11 17:36:56 [error] 53938#53938: *946388 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "GET /wp HTTP/1.1", upstream: "http://103.4.122.14:8181/wp", host: "paramountestate.com.au"
[Wed Mar 11 17:36:56.208740 2026] [:error] [pid 54045:tid 54057] [client 209.38.31.95:40512] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp"] [unique_id "abE3uCRcKzQ1f-N8TgR6KAAAAMo"]
2026/03/11 17:36:56 [error] 53943#53943: *946392 access forbidden by rule, client: 209.38.31.95, server: paramountestate.com.au, request: "GET /.git/config HTTP/1.1", host: "paramountestate.com.au"
2026/03/11 17:36:56 [error] 53947#53947: *946393 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "GET /debug/default/index HTTP/1.1", upstream: "http://103.4.122.14:8181/debug/default/index", host: "paramountestate.com.au"
[Wed Mar 11 17:36:56.220336 2026] [:error] [pid 54045:tid 54066] [client 209.38.31.95:40514] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/debug/default/index"] [unique_id "abE3uCRcKzQ1f-N8TgR6KQAAANM"]
[Wed Mar 11 17:36:56.220812 2026] [:error] [pid 54045:tid 54051] [client 209.38.31.95:40516] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "abE3uCRcKzQ1f-N8TgR6KgAAAMQ"]
2026/03/11 17:36:56 [error] 53943#53943: *946394 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "GET / HTTP/1.1", upstream: "http://103.4.122.14:8181/", host: "paramountestate.com.au"
2026/03/11 17:36:56 [error] 53947#53947: *946395 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "GET /wordpress HTTP/1.1", upstream: "http://103.4.122.14:8181/wordpress", host: "paramountestate.com.au"
[Wed Mar 11 17:36:56.222396 2026] [:error] [pid 44800:tid 44826] [client 209.38.31.95:40518] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wordpress"] [unique_id "abE3uDN8ZerbIEHTO2qUCAAAAdg"]
[Wed Mar 11 17:36:56.229410 2026] [:error] [pid 54045:tid 54071] [client 209.38.31.95:40520] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/blog"] [unique_id "abE3uCRcKzQ1f-N8TgR6KwAAANg"]
2026/03/11 17:36:56 [error] 53947#53947: *946396 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "GET /blog HTTP/1.1", upstream: "http://103.4.122.14:8181/blog", host: "paramountestate.com.au"
[Wed Mar 11 17:36:56.229794 2026] [:error] [pid 54045:tid 54052] [client 209.38.31.95:40524] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/demo"] [unique_id "abE3uCRcKzQ1f-N8TgR6LQAAAMU"]
2026/03/11 17:36:56 [error] 53945#53945: *946398 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "GET /new HTTP/1.1", upstream: "http://103.4.122.14:8181/new", host: "paramountestate.com.au"
[Wed Mar 11 17:36:56.229883 2026] [:error] [pid 54045:tid 54058] [client 209.38.31.95:40522] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/new"] [unique_id "abE3uCRcKzQ1f-N8TgR6LAAAAMs"]
2026/03/11 17:36:56 [error] 53938#53938: *946388 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "GET /demo HTTP/1.1", upstream: "http://103.4.122.14:8181/demo", host: "paramountestate.com.au"
2026/03/11 17:36:56 [error] 53943#53943: *946394 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "POST /vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php HTTP/1.1", upstream: "http://103.4.122.14:8181/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php", host: "paramountestate.com.au"
[Wed Mar 11 17:36:56.235743 2026] [:error] [pid 54045:tid 54048] [client 209.38.31.95:40526] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "abE3uCRcKzQ1f-N8TgR6LgAAAME"]
[Wed Mar 11 17:36:56.236237 2026] [:error] [pid 44882:tid 44901] [client 209.38.31.95:40528] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "abE3uFC06UlbDFYZNg39kAAAAhE"]
2026/03/11 17:36:56 [error] 53947#53947: *946393 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "GET /vendor/laravel-filemanager/js/script.js HTTP/1.1", upstream: "http://103.4.122.14:8181/vendor/laravel-filemanager/js/script.js", host: "paramountestate.com.au"
2026/03/11 17:36:56 [error] 53943#53943: *946392 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "POST / HTTP/1.1", upstream: "http://103.4.122.14:8181/", host: "paramountestate.com.au"
[Wed Mar 11 17:36:56.236301 2026] [:error] [pid 44995:tid 45010] [client 209.38.31.95:40530] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vendor/laravel-filemanager/js/script.js"] [unique_id "abE3uDoOSr9ks_axo6ORhwAAAk0"]
2026/03/11 17:36:56 [error] 53943#53943: *946392 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "GET /_ignition/execute-solution HTTP/1.1", upstream: "http://103.4.122.14:8181/_ignition/execute-solution", host: "paramountestate.com.au"
[Wed Mar 11 17:36:56.252078 2026] [:error] [pid 54045:tid 54060] [client 209.38.31.95:40534] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/_ignition/execute-solution"] [unique_id "abE3uCRcKzQ1f-N8TgR6LwAAAM0"]
2026/03/11 17:36:56 [error] 53938#53938: *946388 upstream prematurely closed connection while reading response header from upstream, client: 209.38.31.95, server: paramountestate.com.au, request: "GET /public/vendor/laravel-filemanager/js/script.js HTTP/1.1", upstream: "http://103.4.122.14:8181/public/vendor/laravel-filemanager/js/script.js", host: "paramountestate.com.au"
[Wed Mar 11 17:36:56.252078 2026] [:error] [pid 44882:tid 44900] [client 209.38.31.95:40532] [client 209.38.31.95] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/vendor/laravel-filemanager/js/script.js"] [unique_id "abE3uFC06UlbDFYZNg39kQAAAhA"]
[Wed Mar 11 22:31:33.325113 2026] [:error] [pid 44882:tid 44892] [client 47.230.10.49:54020] [client 47.230.10.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.4.122.14, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abF8xVC06UlbDFYZNg0LCAAAAgg"]
[Thu Mar 12 04:59:13.065405 2026] [:error] [pid 63256:tid 63277] [client 45.132.115.248:43284] [client 45.132.115.248] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abHXoQhgyalB3r3y_ThHcAAAAM0"]
[Thu Mar 12 04:59:13.884877 2026] [:error] [pid 63256:tid 63288] [client 172.98.33.5:43338] [client 172.98.33.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 103.4.122.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abHXoQhgyalB3r3y_ThHewAAANg"]
[Thu Mar 12 11:54:05.050710 2026] [:error] [pid 22063:tid 22077] [client 193.36.225.203:57059] [client 193.36.225.203] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.203, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abI43a0RUhS-MJyHWLSbtAAAAgw"]
[Thu Mar 12 11:58:13.997738 2026] [:error] [pid 51540:tid 51547] [client 130.12.182.150:46114] [client 130.12.182.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "abI51WOFFjotMIN2UD2J0gAAAMU"]
[Thu Mar 12 11:58:14.584588 2026] [:error] [pid 11953:tid 11961] [client 130.12.182.150:49980] [client 130.12.182.150] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "abI51pudzqsnq3bvtDb9zQAAAUY"]
[Thu Mar 12 16:41:09.262092 2026] [:error] [pid 11985:tid 12005] [client 93.183.176.129:57333] [client 93.183.176.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 93.183.176.129, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abJ8JXcAcNujsOssVDcI4AAAAY4"]
[Thu Mar 12 17:05:36.251770 2026] [:error] [pid 51455:tid 51462] [client 52.138.0.148:58717] [client 52.138.0.148] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.138.0.148, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abKB4JE0YyNxdg6PL_ANkgAAAAI"]
[Thu Mar 12 17:05:41.955017 2026] [:error] [pid 51455:tid 51481] [client 52.138.0.148:58717] [client 52.138.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abKB5ZE0YyNxdg6PL_ANrQAAABU"]
[Thu Mar 12 17:05:44.557301 2026] [:error] [pid 8249:tid 8264] [client 52.138.0.148:14272] [client 52.138.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "abKB6CK5dL3-8Jdf0M3m5AAAAQ0"]
[Thu Mar 12 17:05:46.227482 2026] [:error] [pid 22063:tid 22077] [client 52.138.0.148:14280] [client 52.138.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "abKB6q0RUhS-MJyHWLQFbwAAAgw"]
[Thu Mar 12 17:05:48.733170 2026] [:error] [pid 11953:tid 11974] [client 52.138.0.148:14285] [client 52.138.0.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "abKB7Judzqsnq3bvtDYZeAAAAVM"]
[Thu Mar 12 18:25:21.491808 2026] [:error] [pid 51455:tid 51462] [client 103.65.236.149:52835] [client 103.65.236.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "abKUkZE0YyNxdg6PL_AvLQAAAAI"]
[Thu Mar 12 18:25:21.710627 2026] [:error] [pid 51455:tid 51472] [client 103.65.236.149:52856] [client 103.65.236.149] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.vscode/sftp.json"] [unique_id "abKUkZE0YyNxdg6PL_AvLgAAAAw"]
[Fri Mar 13 01:59:25.498172 2026] [:error] [pid 47893:tid 47987] [client 193.36.225.53:65071] [client 193.36.225.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.53, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abL-_QYSdu6aqxO_YucpWAAAAIw"]
[Fri Mar 13 07:05:45.005747 2026] [:error] [pid 44755:tid 44770] [client 152.59.145.163:59522] [client 152.59.145.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 152.59.145.163, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abNGyfONf1H0XrBFE4OOogAAAQ0"]
[Fri Mar 13 09:50:27.740198 2026] [:error] [pid 55077:tid 55092] [client 209.87.169.138:42019] [client 209.87.169.138] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 209.87.169.138, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abNtY99Ul5ym4M-PlQJV6gAAAU0"]
[Fri Mar 13 11:15:27.650737 2026] [:error] [pid 9309:tid 9337] [client 136.144.35.39:36161] [client 136.144.35.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 136.144.35.39, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abOBT6o1KEMMghNWAN9qfAAAAg4"]
[Fri Mar 13 18:30:16.602449 2026] [:error] [pid 9309:tid 9329] [client 39.63.86.37:62461] [client 39.63.86.37] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.63.86.37, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abPnOKo1KEMMghNWAN8iXwAAAgY"]
[Fri Mar 13 18:31:16.094635 2026] [:error] [pid 61928:tid 61995] [client 106.51.105.77:54317] [client 106.51.105.77] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.105.77, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abPndAod66AHekJJZiqWnAAAAFI"]
[Fri Mar 13 19:57:10.928360 2026] [:error] [pid 44755:tid 44779] [client 104.28.166.127:24910] [client 104.28.166.127] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/style.php"] [unique_id "abP7lvONf1H0XrBFE4NetAAAARY"]
[Fri Mar 13 20:39:08.410451 2026] [:error] [pid 61928:tid 61996] [client 181.124.145.167:49663] [client 181.124.145.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.124.145.167, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abQFbAod66AHekJJZiqjcgAAAFM"]
[Fri Mar 13 20:46:38.458035 2026] [:error] [pid 9111:tid 9134] [client 59.91.133.150:54447] [client 59.91.133.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 59.91.133.150, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abQHLk-M156SLpD2BrtOYgAAAYg"]
[Fri Mar 13 21:52:06.106377 2026] [:error] [pid 60496:tid 60505] [client 51.89.43.80:62467] [client 51.89.43.80] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "abQWhgb67oGiJ3jaL8wBXAAAA0E"]
[Fri Mar 13 22:59:51.204881 2026] [:error] [pid 61929:tid 62006] [client 20.151.4.179:14280] [client 20.151.4.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "abQmZzGGsow2jgUjLty_6AAAAII"]
[Fri Mar 13 22:59:52.033213 2026] [:error] [pid 60436:tid 60470] [client 20.151.4.179:14286] [client 20.151.4.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/index.php"] [unique_id "abQmaII3PEddCArY1AasRgAAAwE"]
[Fri Mar 13 22:59:52.866441 2026] [:error] [pid 60398:tid 60415] [client 20.151.4.179:14314] [client 20.151.4.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "abQmaECJdGSTt6QlH2BadQAAAow"]
[Sat Mar 14 01:26:12.085699 2026] [:error] [pid 47905:tid 48017] [client 4.204.197.4:30703] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/doc.php"] [unique_id "abRItBaYZayP4o4wpJciGAAAAVg"]
[Sat Mar 14 01:26:12.497136 2026] [:error] [pid 47878:tid 47940] [client 4.204.197.4:30670] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/doc.php"] [unique_id "abRItH8jymmmpr1jcBesjAAAAEE"]
[Sat Mar 14 01:26:12.908604 2026] [:error] [pid 47878:tid 47963] [client 4.204.197.4:30607] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/doc.php"] [unique_id "abRItH8jymmmpr1jcBesjgAAAFg"]
[Sat Mar 14 01:26:13.332119 2026] [:error] [pid 47878:tid 47952] [client 4.204.197.4:30666] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/doc.php"] [unique_id "abRItX8jymmmpr1jcBeskQAAAE0"]
[Sat Mar 14 01:26:13.746301 2026] [:error] [pid 47905:tid 48014] [client 4.204.197.4:30684] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/packed.php"] [unique_id "abRItRaYZayP4o4wpJciGgAAAVU"]
[Sat Mar 14 01:26:14.157585 2026] [:error] [pid 47878:tid 47949] [client 4.204.197.4:30659] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/packed.php"] [unique_id "abRItn8jymmmpr1jcBeslQAAAEo"]
[Sat Mar 14 01:26:14.576798 2026] [:error] [pid 47878:tid 47939] [client 4.204.197.4:30685] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/packed.php"] [unique_id "abRItn8jymmmpr1jcBesmAAAAEA"]
[Sat Mar 14 01:26:15.008637 2026] [:error] [pid 47891:tid 47972] [client 4.204.197.4:30605] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/packed.php"] [unique_id "abRIt_chNnuMqi7I_WH3lAAAAIY"]
[Sat Mar 14 01:26:15.455639 2026] [:error] [pid 47905:tid 48009] [client 4.204.197.4:30702] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/click.php"] [unique_id "abRItxaYZayP4o4wpJciHAAAAVA"]
[Sat Mar 14 01:26:15.891591 2026] [:error] [pid 47905:tid 48004] [client 4.204.197.4:30682] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/click.php"] [unique_id "abRItxaYZayP4o4wpJciHQAAAUs"]
[Sat Mar 14 01:26:16.337559 2026] [:error] [pid 47878:tid 47957] [client 4.204.197.4:30664] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/click.php"] [unique_id "abRIuH8jymmmpr1jcBesoQAAAFI"]
[Sat Mar 14 01:26:16.829042 2026] [:error] [pid 47878:tid 47949] [client 4.204.197.4:30662] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/click.php"] [unique_id "abRIuH8jymmmpr1jcBesowAAAEo"]
[Sat Mar 14 01:26:17.278322 2026] [:error] [pid 47878:tid 47955] [client 4.204.197.4:30674] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "abRIuX8jymmmpr1jcBespQAAAFA"]
[Sat Mar 14 01:26:17.714785 2026] [:error] [pid 47891:tid 47970] [client 4.204.197.4:30718] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "abRIufchNnuMqi7I_WH3ngAAAIQ"]
[Sat Mar 14 01:26:18.149595 2026] [:error] [pid 47891:tid 47984] [client 4.204.197.4:30719] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "abRIuvchNnuMqi7I_WH3oQAAAJI"]
[Sat Mar 14 01:26:18.595460 2026] [:error] [pid 47878:tid 47963] [client 4.204.197.4:30593] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "abRIun8jymmmpr1jcBesqQAAAFg"]
[Sat Mar 14 01:26:19.037272 2026] [:error] [pid 47905:tid 48000] [client 4.204.197.4:30660] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/function.php"] [unique_id "abRIuxaYZayP4o4wpJciHwAAAUc"]
[Sat Mar 14 01:26:19.454345 2026] [:error] [pid 47891:tid 47976] [client 4.204.197.4:30656] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/function.php"] [unique_id "abRIu_chNnuMqi7I_WH3pAAAAIo"]
[Sat Mar 14 01:26:19.869989 2026] [:error] [pid 47905:tid 47995] [client 4.204.197.4:30696] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/function.php"] [unique_id "abRIuxaYZayP4o4wpJciIQAAAUI"]
[Sat Mar 14 01:26:20.282759 2026] [:error] [pid 48070:tid 48094] [client 4.204.197.4:30712] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/function.php"] [unique_id "abRIvEIvrhMS5BVHxNkcBgAAABY"]
[Sat Mar 14 01:26:20.699287 2026] [:error] [pid 48070:tid 48077] [client 4.204.197.4:30688] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mail.php"] [unique_id "abRIvEIvrhMS5BVHxNkcCQAAAAU"]
[Sat Mar 14 01:26:21.119672 2026] [:error] [pid 48070:tid 48095] [client 4.204.197.4:30713] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mail.php"] [unique_id "abRIvUIvrhMS5BVHxNkcDAAAABc"]
[Sat Mar 14 01:26:21.535046 2026] [:error] [pid 47878:tid 47953] [client 4.204.197.4:30609] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mail.php"] [unique_id "abRIvX8jymmmpr1jcBesrwAAAE4"]
[Sat Mar 14 01:26:21.945327 2026] [:error] [pid 47905:tid 48000] [client 4.204.197.4:30669] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mail.php"] [unique_id "abRIvRaYZayP4o4wpJciKwAAAUc"]
[Sat Mar 14 01:26:22.355873 2026] [:error] [pid 48070:tid 48085] [client 4.204.197.4:30592] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xmrlpc.php"] [unique_id "abRIvkIvrhMS5BVHxNkcDgAAAA0"]
[Sat Mar 14 01:26:22.768864 2026] [:error] [pid 47878:tid 47952] [client 4.204.197.4:30717] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xmrlpc.php"] [unique_id "abRIvn8jymmmpr1jcBessgAAAE0"]
[Sat Mar 14 01:26:23.179409 2026] [:error] [pid 48070:tid 48083] [client 4.204.197.4:30645] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xmrlpc.php"] [unique_id "abRIv0IvrhMS5BVHxNkcEQAAAAs"]
[Sat Mar 14 01:26:23.591332 2026] [:error] [pid 48070:tid 48092] [client 4.204.197.4:30597] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xmrlpc.php"] [unique_id "abRIv0IvrhMS5BVHxNkcFgAAABQ"]
[Sat Mar 14 01:26:24.002660 2026] [:error] [pid 47878:tid 47956] [client 4.204.197.4:30673] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/network.php"] [unique_id "abRIwH8jymmmpr1jcBestgAAAFE"]
[Sat Mar 14 01:26:24.412753 2026] [:error] [pid 47905:tid 48009] [client 4.204.197.4:30630] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/network.php"] [unique_id "abRIwBaYZayP4o4wpJciMwAAAVA"]
[Sat Mar 14 01:26:24.828774 2026] [:error] [pid 47878:tid 47939] [client 4.204.197.4:30625] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/network.php"] [unique_id "abRIwH8jymmmpr1jcBesuAAAAEA"]
[Sat Mar 14 01:26:25.243785 2026] [:error] [pid 47878:tid 47959] [client 4.204.197.4:30601] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/network.php"] [unique_id "abRIwX8jymmmpr1jcBesuwAAAFQ"]
[Sat Mar 14 01:26:25.664205 2026] [:error] [pid 48070:tid 48078] [client 4.204.197.4:30672] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/content.php"] [unique_id "abRIwUIvrhMS5BVHxNkcGAAAAAY"]
[Sat Mar 14 01:26:26.079614 2026] [:error] [pid 47905:tid 48012] [client 4.204.197.4:30624] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/content.php"] [unique_id "abRIwhaYZayP4o4wpJciNAAAAVM"]
[Sat Mar 14 01:26:26.491769 2026] [:error] [pid 47878:tid 47950] [client 4.204.197.4:30701] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/content.php"] [unique_id "abRIwn8jymmmpr1jcBesvQAAAEs"]
[Sat Mar 14 01:26:26.934225 2026] [:error] [pid 48070:tid 48077] [client 4.204.197.4:30706] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/content.php"] [unique_id "abRIwkIvrhMS5BVHxNkcGQAAAAU"]
[Sat Mar 14 01:26:27.349861 2026] [:error] [pid 48070:tid 48095] [client 4.204.197.4:30642] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/atomlib.php"] [unique_id "abRIw0IvrhMS5BVHxNkcGgAAABc"]
[Sat Mar 14 01:26:27.764888 2026] [:error] [pid 47905:tid 48010] [client 4.204.197.4:30633] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/atomlib.php"] [unique_id "abRIwxaYZayP4o4wpJciNwAAAVE"]
[Sat Mar 14 01:26:28.176100 2026] [:error] [pid 47878:tid 47942] [client 4.204.197.4:30610] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/atomlib.php"] [unique_id "abRIxH8jymmmpr1jcBeswwAAAEM"]
[Sat Mar 14 01:26:28.598141 2026] [:error] [pid 47878:tid 47961] [client 4.204.197.4:30621] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/atomlib.php"] [unique_id "abRIxH8jymmmpr1jcBesxgAAAFY"]
[Sat Mar 14 01:26:29.025055 2026] [:error] [pid 47905:tid 47999] [client 4.204.197.4:30603] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws.php"] [unique_id "abRIxRaYZayP4o4wpJciPQAAAUY"]
[Sat Mar 14 01:26:29.439568 2026] [:error] [pid 47878:tid 47963] [client 4.204.197.4:30596] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws.php"] [unique_id "abRIxX8jymmmpr1jcBeszgAAAFg"]
[Sat Mar 14 01:26:29.866331 2026] [:error] [pid 48070:tid 48083] [client 4.204.197.4:30661] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws.php"] [unique_id "abRIxUIvrhMS5BVHxNkcHAAAAAs"]
[Sat Mar 14 01:26:30.319305 2026] [:error] [pid 48070:tid 48089] [client 4.204.197.4:30700] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws.php"] [unique_id "abRIxkIvrhMS5BVHxNkcIAAAABE"]
[Sat Mar 14 01:26:30.735659 2026] [:error] [pid 48070:tid 48075] [client 4.204.197.4:30608] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shell.php"] [unique_id "abRIxkIvrhMS5BVHxNkcJAAAAAM"]
[Sat Mar 14 01:26:31.153820 2026] [:error] [pid 47878:tid 47940] [client 4.204.197.4:30542] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shell.php"] [unique_id "abRIx38jymmmpr1jcBes4wAAAEE"]
[Sat Mar 14 01:26:31.567850 2026] [:error] [pid 47878:tid 47958] [client 4.204.197.4:30655] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shell.php"] [unique_id "abRIx38jymmmpr1jcBes5gAAAFM"]
[Sat Mar 14 01:26:31.984531 2026] [:error] [pid 47891:tid 47983] [client 4.204.197.4:30612] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shell.php"] [unique_id "abRIx_chNnuMqi7I_WH3qgAAAJE"]
[Sat Mar 14 01:26:32.402479 2026] [:error] [pid 47891:tid 47977] [client 4.204.197.4:30707] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock.php"] [unique_id "abRIyPchNnuMqi7I_WH3rAAAAIs"]
[Sat Mar 14 01:26:32.820668 2026] [:error] [pid 47891:tid 47976] [client 4.204.197.4:30657] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock.php"] [unique_id "abRIyPchNnuMqi7I_WH3rwAAAIo"]
[Sat Mar 14 01:26:33.230979 2026] [:error] [pid 47891:tid 47988] [client 4.204.197.4:30653] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock.php"] [unique_id "abRIyfchNnuMqi7I_WH3sAAAAJY"]
[Sat Mar 14 01:26:33.644206 2026] [:error] [pid 47891:tid 47987] [client 4.204.197.4:30531] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock.php"] [unique_id "abRIyfchNnuMqi7I_WH3sQAAAJU"]
[Sat Mar 14 01:26:34.063135 2026] [:error] [pid 47891:tid 47989] [client 4.204.197.4:30694] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "abRIyvchNnuMqi7I_WH3tAAAAJc"]
[Sat Mar 14 01:26:34.476107 2026] [:error] [pid 47878:tid 47953] [client 4.204.197.4:30623] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "abRIyn8jymmmpr1jcBes8gAAAE4"]
[Sat Mar 14 01:26:34.904975 2026] [:error] [pid 47891:tid 47969] [client 4.204.197.4:30599] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "abRIyvchNnuMqi7I_WH3tQAAAIM"]
[Sat Mar 14 01:26:35.321450 2026] [:error] [pid 48070:tid 48092] [client 4.204.197.4:30629] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "abRIy0IvrhMS5BVHxNkcLgAAABQ"]
[Sat Mar 14 01:26:35.733042 2026] [:error] [pid 48070:tid 48094] [client 4.204.197.4:30681] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin.php"] [unique_id "abRIy0IvrhMS5BVHxNkcMAAAABY"]
[Sat Mar 14 01:26:36.143013 2026] [:error] [pid 48070:tid 48080] [client 4.204.197.4:30710] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin.php"] [unique_id "abRIzEIvrhMS5BVHxNkcMQAAAAg"]
[Sat Mar 14 01:26:36.554976 2026] [:error] [pid 48070:tid 48079] [client 4.204.197.4:30594] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin.php"] [unique_id "abRIzEIvrhMS5BVHxNkcMwAAAAc"]
[Sat Mar 14 01:26:36.987941 2026] [:error] [pid 47905:tid 48011] [client 4.204.197.4:30631] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin.php"] [unique_id "abRIzBaYZayP4o4wpJciSQAAAVI"]
[Sat Mar 14 01:26:37.399241 2026] [:error] [pid 47878:tid 47957] [client 4.204.197.4:30680] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "abRIzX8jymmmpr1jcBes9QAAAFI"]
[Sat Mar 14 01:26:37.810095 2026] [:error] [pid 47905:tid 48003] [client 4.204.197.4:30690] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "abRIzRaYZayP4o4wpJciSwAAAUo"]
[Sat Mar 14 01:26:38.222209 2026] [:error] [pid 48070:tid 48086] [client 4.204.197.4:30563] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "abRIzkIvrhMS5BVHxNkcOQAAAA4"]
[Sat Mar 14 01:26:38.632973 2026] [:error] [pid 47891:tid 47966] [client 4.204.197.4:30683] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "abRIzvchNnuMqi7I_WH3twAAAIA"]
[Sat Mar 14 01:26:39.051587 2026] [:error] [pid 47878:tid 47945] [client 4.204.197.4:30620] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/test.php"] [unique_id "abRIz38jymmmpr1jcBes9gAAAEY"]
[Sat Mar 14 01:26:39.490519 2026] [:error] [pid 47891:tid 47971] [client 4.204.197.4:30613] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/test.php"] [unique_id "abRIz_chNnuMqi7I_WH3uQAAAIU"]
[Sat Mar 14 01:26:39.906645 2026] [:error] [pid 47878:tid 47949] [client 4.204.197.4:30677] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/test.php"] [unique_id "abRIz38jymmmpr1jcBes-AAAAEo"]
[Sat Mar 14 01:26:40.332642 2026] [:error] [pid 47891:tid 47978] [client 4.204.197.4:30626] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/test.php"] [unique_id "abRI0PchNnuMqi7I_WH3uwAAAIw"]
[Sat Mar 14 01:26:40.751072 2026] [:error] [pid 47905:tid 48016] [client 4.204.197.4:30595] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRI0BaYZayP4o4wpJciUAAAAVc"]
[Sat Mar 14 01:26:41.162616 2026] [:error] [pid 47905:tid 48017] [client 4.204.197.4:30638] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRI0RaYZayP4o4wpJciUgAAAVg"]
[Sat Mar 14 01:26:41.576750 2026] [:error] [pid 47878:tid 47946] [client 4.204.197.4:30654] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRI0X8jymmmpr1jcBes_AAAAEc"]
[Sat Mar 14 01:26:41.991850 2026] [:error] [pid 47891:tid 47980] [client 4.204.197.4:30705] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "abRI0fchNnuMqi7I_WH3vQAAAI4"]
[Sat Mar 14 01:26:42.411598 2026] [:error] [pid 47891:tid 47988] [client 4.204.197.4:30639] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "abRI0vchNnuMqi7I_WH3vwAAAJY"]
[Sat Mar 14 01:26:42.860655 2026] [:error] [pid 47891:tid 47967] [client 4.204.197.4:30648] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "abRI0vchNnuMqi7I_WH3wQAAAIE"]
[Sat Mar 14 01:26:43.365012 2026] [:error] [pid 47905:tid 48009] [client 4.204.197.4:30671] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "abRI0xaYZayP4o4wpJciVgAAAVA"]
[Sat Mar 14 01:26:43.824682 2026] [:error] [pid 47878:tid 47953] [client 4.204.197.4:30675] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "abRI038jymmmpr1jcBetAAAAAE4"]
[Sat Mar 14 01:26:44.244265 2026] [:error] [pid 48070:tid 48075] [client 4.204.197.4:30569] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/up.php"] [unique_id "abRI1EIvrhMS5BVHxNkcPAAAAAM"]
[Sat Mar 14 01:26:44.691834 2026] [:error] [pid 48070:tid 48085] [client 4.204.197.4:30615] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/up.php"] [unique_id "abRI1EIvrhMS5BVHxNkcPwAAAA0"]
[Sat Mar 14 01:26:45.164580 2026] [:error] [pid 48070:tid 48093] [client 4.204.197.4:30627] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/up.php"] [unique_id "abRI1UIvrhMS5BVHxNkcRAAAABU"]
[Sat Mar 14 01:26:45.581356 2026] [:error] [pid 48070:tid 48096] [client 4.204.197.4:30692] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/up.php"] [unique_id "abRI1UIvrhMS5BVHxNkcRgAAABg"]
[Sat Mar 14 01:26:46.021654 2026] [:error] [pid 48070:tid 48091] [client 4.204.197.4:30606] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "abRI1kIvrhMS5BVHxNkcSAAAABM"]
[Sat Mar 14 01:26:46.440696 2026] [:error] [pid 47878:tid 47941] [client 4.204.197.4:30679] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "abRI1n8jymmmpr1jcBetAwAAAEI"]
[Sat Mar 14 01:26:46.850206 2026] [:error] [pid 47891:tid 47982] [client 4.204.197.4:30535] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "abRI1vchNnuMqi7I_WH3xAAAAJA"]
[Sat Mar 14 01:26:47.317400 2026] [:error] [pid 47891:tid 47979] [client 4.204.197.4:30635] [client 4.204.197.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "abRI1_chNnuMqi7I_WH3xgAAAI0"]
[Sat Mar 14 01:41:37.441101 2026] [:error] [pid 48070:tid 48093] [client 4.204.233.55:12989] [client 4.204.233.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "abRMUUIvrhMS5BVHxNkm-QAAABU"]
[Sat Mar 14 01:41:38.272935 2026] [:error] [pid 47878:tid 47957] [client 4.204.233.55:12969] [client 4.204.233.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/index.php"] [unique_id "abRMUn8jymmmpr1jcBewMQAAAFI"]
[Sat Mar 14 01:41:39.117863 2026] [:error] [pid 47878:tid 47943] [client 4.204.233.55:12937] [client 4.204.233.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "abRMU38jymmmpr1jcBewMwAAAEQ"]
[Sat Mar 14 05:59:56.511256 2026] [:error] [pid 3913:tid 3966] [client 185.137.164.21:29541] [client 185.137.164.21] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "abSI3B9qvQd4GQHUp68ElAAAAEk"]
[Sat Mar 14 05:59:57.274536 2026] [:error] [pid 3914:tid 3988] [client 185.137.164.17:29551] [client 185.137.164.17] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "abSI3fH_HeUqa_sn9-ANAgAAAIQ"]
[Sat Mar 14 10:54:22.554724 2026] [:error] [pid 3913:tid 3979] [client 197.45.253.22:60491] [client 197.45.253.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 197.45.253.22, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abTN3h9qvQd4GQHUp69ZsAAAAFY"]
[Sat Mar 14 16:49:20.710924 2026] [:error] [pid 61384:tid 61465] [client 173.239.224.115:58869] [client 173.239.224.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.115, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abUhEPzibL2IYJprDHKdvwAAAdY"]
[Sat Mar 14 16:49:21.538712 2026] [:error] [pid 61477:tid 61498] [client 173.239.224.109:44765] [client 173.239.224.109] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.109, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abUhEacx6muYfIYRM7CmyQAAAFE"]
[Sun Mar 15 01:09:55.718361 2026] [:error] [pid 19680:tid 20000] [client 45.131.195.211:55647] [client 45.131.195.211] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.131.195.211, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abWWY0nhGahR8LEhCX-d7AAAAcg"]
[Sun Mar 15 04:09:18.655145 2026] [:error] [pid 38645:tid 38669] [client 52.139.198.173:12963] [client 52.139.198.173] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.139.198.173, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abXAbhFPHtsDUuVrWDYyxgAAANY"]
[Sun Mar 15 04:09:20.928305 2026] [:error] [pid 38645:tid 38666] [client 52.139.198.173:12963] [client 52.139.198.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.139.198.173, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abXAcBFPHtsDUuVrWDYy1wAAANM"]
[Sun Mar 15 04:09:22.401894 2026] [:error] [pid 38645:tid 38648] [client 52.139.198.173:12963] [client 52.139.198.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "abXAchFPHtsDUuVrWDYy7AAAAME"]
[Sun Mar 15 11:18:01.426845 2026] [:error] [pid 38541:tid 38616] [client 109.71.177.133:54254] [client 109.71.177.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.71.177.133, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abYk6XuOpex8jIO0jt5bXgAAAIM"]
[Sun Mar 15 16:13:19.234377 2026] [:error] [pid 45801:tid 45815] [client 104.234.53.82:35627] [client 104.234.53.82] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.82, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abZqH4aKHL9CTKoVzTAKagAAAcw"]
[Sun Mar 15 19:01:45.208531 2026] [:error] [pid 45801:tid 45818] [client 91.73.97.31:36891] [client 91.73.97.31] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.73.97.31, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abaRmYaKHL9CTKoVzTA8rQAAAc8"]
[Sun Mar 15 23:50:44.910874 2026] [:error] [pid 45801:tid 45803] [client 104.28.246.112:48895] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/style.php"] [unique_id "abbVVIaKHL9CTKoVzTBwBAAAAcA"]
[Sun Mar 15 23:50:45.337526 2026] [:error] [pid 38541:tid 38616] [client 104.28.246.112:46688] [client 104.28.246.112] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/style.php"] [unique_id "abbVVXuOpex8jIO0jt6tVwAAAIM"]
[Mon Mar 16 07:02:28.444089 2026] [:error] [pid 62428:tid 62493] [client 203.188.168.24:30867] [client 203.188.168.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.188.168.24, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abc6hKrHSRXFZx1-aIHoHQAAAFg"]
[Mon Mar 16 07:02:30.297729 2026] [:error] [pid 12768:tid 12776] [client 203.188.168.23:34735] [client 203.188.168.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 203.188.168.23, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abc6hovjhfol0SJym0_AIAAAAYM"]
[Mon Mar 16 08:24:47.245148 2026] [:error] [pid 52152:tid 52157] [client 103.65.237.124:59644] [client 103.65.237.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "abdNz8A6rS_GLRd0NKWQVQAAAQI"]
[Mon Mar 16 10:26:26.041914 2026] [:error] [pid 62026:tid 62099] [client 45.132.225.100:29047] [client 45.132.225.100] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.132.225.100, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abdqUu8oW52PUIYI2O4BjwAAAI0"]
[Mon Mar 16 14:06:09.654718 2026] [:error] [pid 9400:tid 9437] [client 103.105.172.10:30384] [client 103.105.172.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.105.172.10, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abed0QSHzD8ZM8ddLEnrFQAAAhU"]
[Mon Mar 16 20:32:41.120039 2026] [:error] [pid 1871:tid 1892] [client 20.189.93.95:1157] [client 20.189.93.95] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.189.93.95, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abf4aTinTnZ8uiUPekFJ8AAAAZM"]
[Mon Mar 16 21:42:23.042951 2026] [:error] [pid 35929:tid 35934] [client 173.239.224.112:46933] [client 173.239.224.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.112, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abgIv9W47dGpmA63hwSiqwAAAMM"]
[Mon Mar 16 21:42:25.849958 2026] [:error] [pid 1871:tid 1894] [client 173.239.224.116:41503] [client 173.239.224.116] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.224.116, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abgIwTinTnZ8uiUPekFmegAAAZU"]
[Mon Mar 16 22:18:02.435661 2026] [:error] [pid 1871:tid 1877] [client 47.252.18.37:34990] [client 47.252.18.37] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "abgRGjinTnZ8uiUPekF7BAAAAYQ"]
[Mon Mar 16 22:57:33.376014 2026] [:error] [pid 39154:tid 39163] [client 2.222.248.223:51718] [client 2.222.248.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 2.222.248.223, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abgaXRgq1_qjm7J1LqtMuQAAAUY"]
[Tue Mar 17 02:24:50.763749 2026] [:error] [pid 45450:tid 45586] [client 8.213.195.191:22348] [client 8.213.195.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "abhK8r164tBAS29wdMgoZQAAAI8"]
[Tue Mar 17 07:56:12.976687 2026] [:error] [pid 45916:tid 45984] [client 185.223.152.147:40835] [client 185.223.152.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.147, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abiYnLiS53PnClk_C9ATRwAAAFY"]
[Tue Mar 17 14:35:08.474719 2026] [:error] [pid 45916:tid 45966] [client 175.157.92.174:25602] [client 175.157.92.174] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 175.157.92.174, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abj2HLiS53PnClk_C9AHNAAAAEQ"]
[Tue Mar 17 19:04:48.924346 2026] [:error] [pid 15162:tid 15180] [client 143.105.209.22:40907] [client 143.105.209.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 143.105.209.22, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abk1ULkCW4399PnBfYTzKgAAAk0"]
[Tue Mar 17 20:23:42.693966 2026] [:error] [pid 14817:tid 14846] [client 41.250.44.133:5330] [client 41.250.44.133] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "ablHzuBWVgTpR3dKOgZMTgAAAVQ"]
[Wed Mar 18 03:24:38.854895 2026] [:error] [pid 63612:tid 63621] [client 20.116.1.191:5818] [client 20.116.1.191] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.116.1.191, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "abmqdu7vPBSR8vo387NoCQAAAYc"]
[Wed Mar 18 03:24:42.829139 2026] [:error] [pid 63612:tid 63617] [client 20.116.1.191:5818] [client 20.116.1.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abmqeu7vPBSR8vo387NoKAAAAYM"]
[Wed Mar 18 03:24:50.914285 2026] [:error] [pid 63612:tid 63615] [client 20.116.1.191:5778] [client 20.116.1.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "abmqgu7vPBSR8vo387NoTAAAAYE"]
[Wed Mar 18 03:24:54.235722 2026] [:error] [pid 63449:tid 63466] [client 20.116.1.191:5254] [client 20.116.1.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "abmqhgplutP4IZ5mr13y6gAAAU8"]
[Wed Mar 18 03:24:59.422973 2026] [:error] [pid 41165:tid 41172] [client 20.116.1.191:5773] [client 20.116.1.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "abmqi3EHb7dujURQaRbp0gAAAQU"]
[Wed Mar 18 05:41:23.118898 2026] [:error] [pid 44964:tid 44994] [client 193.36.225.241:37631] [client 193.36.225.241] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 193.36.225.241, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abnKg8vMufm4ayzOOhBNhwAAABA"]
[Wed Mar 18 08:13:18.399023 2026] [:error] [pid 13716:tid 13732] [client 20.2.90.103:39128] [client 20.2.90.103] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "abnuHmWKzQVHkZkUHaRT8wAAAU4"]
[Wed Mar 18 21:26:18.864430 2026] [:error] [pid 53755:tid 53777] [client 222.237.95.161:50472] [client 222.237.95.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 222.237.95.161, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abqn-qqw5ZSRshmIhWlUBQAAAVQ"]
[Thu Mar 19 04:52:23.593832 2026] [:error] [pid 23988:tid 24011] [client 106.220.183.198:5922] [client 106.220.183.198] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.220.183.198, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "absQh2nlkSPXj2matr3tnAAAANQ"]
[Thu Mar 19 05:02:44.953968 2026] [:error] [pid 23988:tid 23995] [client 104.28.203.58:14120] [client 104.28.203.58] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/style.php"] [unique_id "absS9GnlkSPXj2matr3ydwAAAMQ"]
[Thu Mar 19 06:31:04.373944 2026] [:error] [pid 3278:tid 3291] [client 31.171.130.43:52575] [client 31.171.130.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 31.171.130.43, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "absnqAC2T_lM6ZgvfcQ0pgAAAQo"]
[Thu Mar 19 07:44:08.548651 2026] [:error] [pid 32226:tid 32243] [client 91.99.177.241:49962] [client 91.99.177.241] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "abs4yLBb58lgPwqxC6qGlQAAAw8"]
[Thu Mar 19 07:44:09.398466 2026] [:error] [pid 32226:tid 32252] [client 46.224.96.103:56254] [client 46.224.96.103] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com.au"] [uri "/"] [unique_id "abs4ybBb58lgPwqxC6qGmgAAAxg"]
[Thu Mar 19 07:59:24.053082 2026] [:error] [pid 31205:tid 31218] [client 91.99.186.247:36006] [client 91.99.186.247] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com.au"] [uri "/"] [unique_id "abs8XFu5gZKGrGz5P1EfwgAAAUI"]
[Thu Mar 19 09:52:09.440582 2026] [:error] [pid 32226:tid 32250] [client 91.99.186.86:33954] [client 91.99.186.86] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com.au"] [uri "/"] [unique_id "abtWybBb58lgPwqxC6rBDAAAAxY"]
[Thu Mar 19 10:00:01.192068 2026] [:error] [pid 23883:tid 23936] [client 209.87.169.235:39027] [client 209.87.169.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "abtYodNi-EnEAH4abz2R3QAAAEc"]
[Thu Mar 19 10:00:02.956398 2026] [:error] [pid 23882:tid 23925] [client 209.87.169.227:52251] [client 209.87.169.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "abtYorWnClbtbN12M78dagAAABc"]
[Thu Mar 19 10:00:04.810538 2026] [:error] [pid 23988:tid 23993] [client 209.87.169.251:28065] [client 209.87.169.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "abtYpGnlkSPXj2matr0uyAAAAMI"]
[Thu Mar 19 12:54:13.465496 2026] [:error] [pid 24971:tid 24986] [client 154.16.49.101:6612] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "abuBdfUcWA7YXQC7dRvaswAAAks"]
[Thu Mar 19 12:54:13.960968 2026] [:error] [pid 31205:tid 31225] [client 154.16.49.101:6775] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/license.txt"] [unique_id "abuBdVu5gZKGrGz5P1GnygAAAUg"]
[Thu Mar 19 12:54:14.455913 2026] [:error] [pid 23884:tid 23960] [client 154.16.49.101:6966] [client 154.16.49.101] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/feed/"] [unique_id "abuBdl6St-VCdOYnZMo0JQAAAIQ"]
[Thu Mar 19 13:24:24.432655 2026] [:error] [pid 25135:tid 25160] [client 103.171.247.168:32991] [client 103.171.247.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.171.247.168, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abuIiKKtE0dzgMctjFX7IQAAA1c"]
[Thu Mar 19 13:24:28.979091 2026] [:error] [pid 23882:tid 23913] [client 106.213.85.115:13473] [client 106.213.85.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.213.85.115, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abuIjLWnClbtbN12M7-nYgAAAAs"]
[Thu Mar 19 21:18:00.948099 2026] [:error] [pid 1285:tid 1290] [client 178.128.102.180:61407] [client 178.128.102.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/speculative8.php"] [unique_id "abv3iFE95r3zR75X1Ho-hwAAAgM"]
[Thu Mar 19 21:18:01.390894 2026] [:error] [pid 51091:tid 51133] [client 178.128.102.180:65321] [client 178.128.102.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abv3ib7LZKhdJPD9CBvaJwAAAVY"]
[Thu Mar 19 21:18:04.903316 2026] [:error] [pid 1247:tid 1271] [client 178.128.102.180:49799] [client 178.128.102.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/speculative8.php"] [unique_id "abv3jA5tmeOr-yI4XNHlYAAAAdY"]
[Thu Mar 19 21:18:05.676285 2026] [:error] [pid 1285:tid 1300] [client 178.128.102.180:49396] [client 178.128.102.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "abv3jVE95r3zR75X1Ho-kQAAAg0"]
[Thu Mar 19 22:45:51.168783 2026] [:error] [pid 11110:tid 11125] [client 20.151.141.24:38339] [client 20.151.141.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.141.24, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abwMHwSNPqGfikw7k8LUlAAAAAo"]
[Thu Mar 19 22:45:53.231622 2026] [:error] [pid 11110:tid 11123] [client 20.151.141.24:38339] [client 20.151.141.24] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.151.141.24, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abwMIQSNPqGfikw7k8LUnQAAAAg"]
[Thu Mar 19 22:45:58.177855 2026] [:error] [pid 11110:tid 11122] [client 20.151.141.24:38339] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "abwMJgSNPqGfikw7k8LUrQAAAAc"]
[Fri Mar 20 00:11:17.115653 2026] [:error] [pid 1397:tid 1400] [client 20.151.141.24:37940] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/test1.php"] [unique_id "abwgJXptc6vBjy-kgOMxdQAAAsE"]
[Fri Mar 20 00:11:19.796437 2026] [:error] [pid 1285:tid 1291] [client 20.151.141.24:37945] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/cropper.php"] [unique_id "abwgJ1E95r3zR75X1Hp8BAAAAgQ"]
[Fri Mar 20 01:14:32.682347 2026] [:error] [pid 46125:tid 46217] [client 209.97.171.56:55353] [client 209.97.171.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "abwu-GgN4lI6NHeckY5cTQAAAIQ"]
[Fri Mar 20 01:14:53.564000 2026] [:error] [pid 46126:tid 46244] [client 115.69.249.3:3531] [client 115.69.249.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.69.249.3, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "abwvDaQ44YePbsZz3j7MjAAAARE"]
[Fri Mar 20 01:35:37.561632 2026] [:error] [pid 46124:tid 46194] [client 20.151.141.24:62240] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/about.php"] [unique_id "abwz6UzMrlLOY6zyCjJ-zgAAAE4"]
[Fri Mar 20 01:35:45.448879 2026] [:error] [pid 11258:tid 11277] [client 20.151.141.24:65513] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "abwz8ZPHb95f6xzHJOceQQAAANE"]
[Fri Mar 20 03:00:26.163557 2026] [:error] [pid 46264:tid 46289] [client 20.151.141.24:38154] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-config.php"] [unique_id "abxHyop3TruHFmWOt5EeegAAAAY"]
[Fri Mar 20 03:00:28.451871 2026] [:error] [pid 46264:tid 46288] [client 20.151.141.24:38145] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "abxHzIp3TruHFmWOt5EegQAAAAU"]
[Fri Mar 20 03:00:30.522249 2026] [:error] [pid 11258:tid 11271] [client 20.151.141.24:38205] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "abxHzpPHb95f6xzHJOdH0gAAAMs"]
[Fri Mar 20 03:00:45.581110 2026] [:error] [pid 46264:tid 46294] [client 20.151.141.24:38181] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "abxH3Yp3TruHFmWOt5EepAAAAAs"]
[Fri Mar 20 03:00:54.277981 2026] [proxy_fcgi:error] [pid 46124:tid 46204] [client 20.151.141.24:38169] AH01071: Got error 'Primary script unknown'
[Fri Mar 20 03:00:54.907149 2026] [:error] [pid 46124:tid 46185] [client 20.151.141.24:38169] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "abxH5kzMrlLOY6zyCjKffgAAAEU"]
[Fri Mar 20 03:00:56.397686 2026] [:error] [pid 46264:tid 46283] [client 20.151.141.24:38176] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "abxH6Ip3TruHFmWOt5EeuQAAAAA"]
[Fri Mar 20 03:00:58.562292 2026] [:error] [pid 46264:tid 46290] [client 20.151.141.24:38193] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "abxH6op3TruHFmWOt5EeyQAAAAc"]
[Fri Mar 20 03:04:33.162586 2026] [:error] [pid 46264:tid 46307] [client 79.127.155.197:63540] [client 79.127.155.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-json/wc/store/v1/cart"] [unique_id "abxIwYp3TruHFmWOt5EhWAAAABg"]
[Fri Mar 20 03:04:33.773273 2026] [:error] [pid 46126:tid 46238] [client 79.127.155.197:63658] [client 79.127.155.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-json/wc/store/v1/payment_methods"] [unique_id "abxIwaQ44YePbsZz3j7rEQAAAQ4"]
[Fri Mar 20 04:24:50.648484 2026] [:error] [pid 58127:tid 58201] [client 20.151.141.24:38144] [client 20.151.141.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.141.24, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/.well-known/wp-login.php"] [unique_id "abxbkrQ_HbYy8C6I_EHRkAAAAII"]
[Fri Mar 20 04:24:54.606228 2026] [:error] [pid 58127:tid 58201] [client 20.151.141.24:38144] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "abxblrQ_HbYy8C6I_EHRnwAAAII"]
[Fri Mar 20 04:24:59.027278 2026] [:error] [pid 58125:tid 58158] [client 20.151.141.24:65497] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/admin.php"] [unique_id "abxbm_KqkvJQoqsQGeVOXwAAAA4"]
[Fri Mar 20 04:25:04.666227 2026] [:error] [pid 58125:tid 58144] [client 20.151.141.24:38203] [client 20.151.141.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.141.24, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "abxboPKqkvJQoqsQGeVObQAAAAA"]
[Fri Mar 20 05:49:49.392508 2026] [:error] [pid 58127:tid 58204] [client 20.151.141.24:62266] [client 20.151.141.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "abxvfbQ_HbYy8C6I_EH6XQAAAIU"]
[Fri Mar 20 05:49:50.735004 2026] [:error] [pid 43163:tid 43190] [client 20.151.141.24:62224] [client 20.151.141.24] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ALFA_DATA/alfacgiapi/perl.alfa"] [unique_id "abxvfp_n4JP_ko9XUswFbAAAARc"]
[Fri Mar 20 05:49:52.650988 2026] [proxy_fcgi:error] [pid 43163:tid 43167] [client 20.151.141.24:62236] AH01071: Got error 'Primary script unknown'
[Fri Mar 20 05:49:56.664765 2026] [:error] [pid 43163:tid 43182] [client 20.151.141.24:62236] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "abxvhJ_n4JP_ko9XUswFnQAAAQ8"]
[Fri Mar 20 05:49:58.372573 2026] [:error] [pid 58126:tid 58187] [client 20.151.141.24:62230] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/allez.php"] [unique_id "abxvhqKAmdXQSS0Y5KBeHAAAAE8"]
[Fri Mar 20 05:50:06.510562 2026] [:error] [pid 58127:tid 58215] [client 20.151.141.24:62256] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/fgertreyersd.php"] [unique_id "abxvjrQ_HbYy8C6I_EH6iQAAAJA"]
[Fri Mar 20 06:04:02.665700 2026] [:error] [pid 43163:tid 43175] [client 198.98.50.128:53204] [client 198.98.50.128] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 198.98.50.128, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abxy0p_n4JP_ko9XUswLuAAAAQg"], referer: http://www.google.com.hk
[Fri Mar 20 07:16:54.566875 2026] [:error] [pid 55452:tid 55502] [client 20.151.141.24:37970] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/chosen.php"] [unique_id "abyD5olFvOIliSP0R2BN1QAAA5M"]
[Fri Mar 20 07:16:56.299070 2026] [:error] [pid 55301:tid 55364] [client 20.151.141.24:62239] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "abyD6MKP1x4sgmjd3xRs3AAAAoI"]
[Fri Mar 20 07:16:58.395800 2026] [:error] [pid 55301:tid 55374] [client 20.151.141.24:37972] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "abyD6sKP1x4sgmjd3xRs5AAAAoo"]
[Fri Mar 20 07:17:01.801615 2026] [:error] [pid 55206:tid 55232] [client 20.151.141.24:62252] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/buy.php"] [unique_id "abyD7XUc_Wl5viVmsDwoKAAAAVg"]
[Fri Mar 20 07:17:09.011137 2026] [:error] [pid 58126:tid 58192] [client 20.151.141.24:62210] [client 20.151.141.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/library/about.php"] [unique_id "abyD9aKAmdXQSS0Y5KBqkwAAAFQ"]
[Fri Mar 20 07:17:10.952578 2026] [:error] [pid 55301:tid 55392] [client 20.151.141.24:62266] [client 20.151.141.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.141.24, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "abyD9sKP1x4sgmjd3xRs9gAAApI"]
[Fri Mar 20 15:10:38.209402 2026] [:error] [pid 27302:tid 27305] [client 185.198.240.236:30833] [client 185.198.240.236] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.236, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "abzy7rDKiUve17xv6yEX0QAAAME"]
[Fri Mar 20 18:28:19.312547 2026] [:error] [pid 49080:tid 49092] [client 49.37.161.192:65240] [client 49.37.161.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.37.161.192, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ab0hQ4k5CHi4V0A3ttjfVAAAAEY"]
[Fri Mar 20 19:16:36.971368 2026] [:error] [pid 49081:tid 49127] [client 106.219.192.234:38242] [client 106.219.192.234] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.219.192.234, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ab0slBo1LBAUhfhYPR15uAAAAQw"]
[Fri Mar 20 20:13:30.101132 2026] [:error] [pid 49082:tid 49152] [client 216.24.212.11:37629] [client 216.24.212.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 216.24.212.11, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ab056qpllYJI1LUIdL-4RAAAAUo"]
[Fri Mar 20 22:20:37.146613 2026] [:error] [pid 38219:tid 38234] [client 185.198.240.40:44759] [client 185.198.240.40] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.198.240.40, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ab1XtXLdNs2F_zXG7H8KyQAAAYQ"]
[Sat Mar 21 10:10:27.683838 2026] [:error] [pid 1490:tid 1536] [client 14.191.130.186:6971] [client 14.191.130.186] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 14.191.130.186, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ab3-E2SWhIPTatyxDeC34AAAAEM"]
[Sat Mar 21 14:02:23.696675 2026] [:error] [pid 49170:tid 49183] [client 103.225.244.141:8134] [client 103.225.244.141] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.225.244.141, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ab40b71KUC-QISS0eWp_3wAAAQs"]
[Sat Mar 21 17:27:46.534598 2026] [:error] [pid 33584:tid 33599] [client 42.119.182.129:52517] [client 42.119.182.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 42.119.182.129, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ab5kkuATEQBBo5z2HkmDAAAAAc0"]
[Sun Mar 22 09:13:51.967576 2026] [:error] [pid 51363:tid 51441] [client 88.235.200.30:39962] [client 88.235.200.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.235.200.30, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ab9CT1wa9x6OCTRkhl2PPAAAAIw"]
[Sun Mar 22 13:02:46.531045 2026] [:error] [pid 51361:tid 51387] [client 118.175.168.59:49923] [client 118.175.168.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 118.175.168.59, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ab939hXYUsdvKC9YWpWE8QAAAA8"]
[Sun Mar 22 20:09:04.104517 2026] [:error] [pid 51468:tid 51483] [client 20.119.51.14:47435] [client 20.119.51.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.119.51.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ab_b4E2TppSvA8W5CBRQUwAAAMc"]
[Sun Mar 22 20:09:06.013894 2026] [:error] [pid 51468:tid 51495] [client 20.119.51.14:47435] [client 20.119.51.14] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.119.51.14, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ab_b4k2TppSvA8W5CBRQXAAAANM"]
[Sun Mar 22 20:09:10.487662 2026] [:error] [pid 51468:tid 51483] [client 20.119.51.14:47435] [client 20.119.51.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ab_b5k2TppSvA8W5CBRQawAAAMc"]
[Sun Mar 22 20:24:32.214336 2026] [:error] [pid 30166:tid 30200] [client 52.139.34.203:49346] [client 52.139.34.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "ab_fgLm4_26jKMD0zy3tJwAAAVc"]
[Sun Mar 22 20:24:35.053467 2026] [:error] [pid 40039:tid 40061] [client 52.139.34.203:49376] [client 52.139.34.203] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "ab_fgx3aDgUJfBYishm11gAAARQ"]
[Sun Mar 22 20:25:48.482144 2026] [:error] [pid 40039:tid 40060] [client 117.194.231.168:63026] [client 117.194.231.168] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.194.231.168, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ab_fzB3aDgUJfBYishm2EAAAARM"]
[Mon Mar 23 02:44:59.520849 2026] [:error] [pid 20574:tid 20590] [client 20.163.240.53:50649] [client 20.163.240.53] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.163.240.53, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acA4q9dMXEnEZrwyzJkYDgAAAAE"]
[Mon Mar 23 02:45:03.161441 2026] [:error] [pid 20574:tid 20595] [client 20.163.240.53:50649] [client 20.163.240.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acA4r9dMXEnEZrwyzJkYJwAAAAY"]
[Mon Mar 23 02:45:05.646710 2026] [:error] [pid 27776:tid 27852] [client 20.163.240.53:50747] [client 20.163.240.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "acA4sY3Eaq7IZ5L-4XVtjAAAAQY"]
[Mon Mar 23 02:45:07.350505 2026] [:error] [pid 20856:tid 20933] [client 20.163.240.53:50694] [client 20.163.240.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "acA4s8xFtXFVNE-X2-KsJwAAAM4"]
[Mon Mar 23 02:45:09.940719 2026] [:error] [pid 20584:tid 20620] [client 20.163.240.53:51105] [client 20.163.240.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "acA4tSWzr-bD_t6AP_TVlgAAAEQ"]
[Mon Mar 23 03:42:41.082891 2026] [:error] [pid 19994:tid 20022] [client 176.28.195.193:10737] [client 176.28.195.193] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 176.28.195.193, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acBGMQ6yUXcuYrad4RmSCwAAABY"]
[Mon Mar 23 13:16:03.827834 2026] [:error] [pid 23439:tid 23456] [client 139.135.192.223:58594] [client 139.135.192.223] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 139.135.192.223, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acDMk6Zv8XIzUKdgaMduuAAAAAc"]
[Mon Mar 23 16:50:08.877397 2026] [:error] [pid 57265:tid 57273] [client 173.239.218.156:37843] [client 173.239.218.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "acD-wGNLjPJJkhuqCsj_BgAAAQY"]
[Mon Mar 23 17:17:04.195103 2026] [:error] [pid 23439:tid 23462] [client 20.85.212.10:60789] [client 20.85.212.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.85.212.10, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acEFEKZv8XIzUKdgaMeItwAAAA0"]
[Mon Mar 23 17:17:07.583586 2026] [:error] [pid 23439:tid 23464] [client 20.85.212.10:60789] [client 20.85.212.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.85.212.10, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acEFE6Zv8XIzUKdgaMeIwgAAAA8"]
[Mon Mar 23 17:17:10.966356 2026] [:error] [pid 23439:tid 23461] [client 20.85.212.10:60789] [client 20.85.212.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "acEFFqZv8XIzUKdgaMeI0QAAAAw"]
[Mon Mar 23 19:22:27.469638 2026] [:error] [pid 14573:tid 14596] [client 20.85.212.10:9207] [client 20.85.212.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.85.212.10, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acEic--oSmHn3q4_J1HgaAAAAVU"]
[Mon Mar 23 19:22:29.451622 2026] [:error] [pid 14573:tid 14598] [client 20.85.212.10:9207] [client 20.85.212.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.85.212.10, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acEide-oSmHn3q4_J1HgcQAAAVc"]
[Mon Mar 23 19:22:35.193953 2026] [:error] [pid 14573:tid 14596] [client 20.85.212.10:9207] [client 20.85.212.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "acEie--oSmHn3q4_J1HggAAAAVU"]
[Mon Mar 23 19:34:48.280702 2026] [:error] [pid 57265:tid 57280] [client 51.103.45.93:37888] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acElWGNLjPJJkhuqCshoCQAAAQ0"]
[Mon Mar 23 19:34:49.030699 2026] [:error] [pid 35165:tid 35184] [client 51.103.45.93:57766] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acElWc6udpN6Esk7JKvO_gAAAZA"]
[Mon Mar 23 19:34:49.821367 2026] [:error] [pid 23440:tid 23476] [client 51.103.45.93:28571] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acElWT49_8n8h_ttcUo-TwAAAEA"]
[Mon Mar 23 19:34:52.188055 2026] [:error] [pid 57265:tid 57276] [client 51.103.45.93:28585] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acElXGNLjPJJkhuqCshoCwAAAQk"]
[Mon Mar 23 19:34:52.930117 2026] [:error] [pid 14573:tid 14575] [client 51.103.45.93:41986] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/19.php"] [unique_id "acElXO-oSmHn3q4_J1HmQQAAAUA"]
[Mon Mar 23 19:34:53.571523 2026] [:error] [pid 35165:tid 35180] [client 51.103.45.93:38376] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/19.php"] [unique_id "acElXc6udpN6Esk7JKvPAQAAAYw"]
[Mon Mar 23 19:34:54.213393 2026] [:error] [pid 23539:tid 23563] [client 51.103.45.93:53953] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/19.php"] [unique_id "acElXn7Dh3qWGSpIAZUxSAAAAM8"]
[Mon Mar 23 19:34:54.880711 2026] [:error] [pid 57265:tid 57267] [client 51.103.45.93:3554] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/19.php"] [unique_id "acElXmNLjPJJkhuqCshoFAAAAQA"]
[Mon Mar 23 19:34:55.748998 2026] [:error] [pid 35165:tid 35176] [client 51.103.45.93:41846] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acElX86udpN6Esk7JKvPBwAAAYg"]
[Mon Mar 23 19:34:56.719895 2026] [:error] [pid 35165:tid 35191] [client 51.103.45.93:64932] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acElYM6udpN6Esk7JKvPCAAAAZc"]
[Mon Mar 23 19:34:57.549971 2026] [:error] [pid 23539:tid 23567] [client 51.103.45.93:50248] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acElYX7Dh3qWGSpIAZUxSgAAANM"]
[Mon Mar 23 19:34:58.175110 2026] [:error] [pid 14573:tid 14588] [client 51.103.45.93:64927] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acElYu-oSmHn3q4_J1HmSgAAAU0"]
[Mon Mar 23 19:34:58.800901 2026] [:error] [pid 57265:tid 57279] [client 51.103.45.93:41810] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file61.php"] [unique_id "acElYmNLjPJJkhuqCshoKgAAAQw"]
[Mon Mar 23 19:35:00.236677 2026] [:error] [pid 57265:tid 57282] [client 51.103.45.93:38381] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file61.php"] [unique_id "acElZGNLjPJJkhuqCshoMQAAAQ8"]
[Mon Mar 23 19:35:01.286281 2026] [:error] [pid 23539:tid 23548] [client 51.103.45.93:41989] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file61.php"] [unique_id "acElZX7Dh3qWGSpIAZUxTQAAAMA"]
[Mon Mar 23 19:35:04.083464 2026] [:error] [pid 23439:tid 23464] [client 51.103.45.93:52673] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file61.php"] [unique_id "acElaKZv8XIzUKdgaMeZqgAAAA8"]
[Mon Mar 23 19:35:05.267715 2026] [:error] [pid 35165:tid 35189] [client 51.103.45.93:41999] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acElac6udpN6Esk7JKvPEQAAAZU"]
[Mon Mar 23 19:35:05.847825 2026] [:error] [pid 23441:tid 23508] [client 51.103.45.93:38370] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acElaRq7S-oOqSXZEr7pggAAAIU"]
[Mon Mar 23 19:35:06.925681 2026] [:error] [pid 23441:tid 23509] [client 51.103.45.93:50241] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acElahq7S-oOqSXZEr7phAAAAIY"]
[Mon Mar 23 19:35:07.704699 2026] [:error] [pid 23441:tid 23522] [client 51.103.45.93:52707] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acElaxq7S-oOqSXZEr7phwAAAJM"]
[Mon Mar 23 19:35:08.477802 2026] [:error] [pid 23439:tid 23465] [client 51.103.45.93:34906] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/settings.php"] [unique_id "acElbKZv8XIzUKdgaMeZrwAAABA"]
[Mon Mar 23 19:35:09.169858 2026] [:error] [pid 35165:tid 35169] [client 51.103.45.93:55287] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/settings.php"] [unique_id "acElbc6udpN6Esk7JKvPFQAAAYE"]
[Mon Mar 23 19:35:09.957439 2026] [:error] [pid 35165:tid 35181] [client 51.103.45.93:50271] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/settings.php"] [unique_id "acElbc6udpN6Esk7JKvPGQAAAY0"]
[Mon Mar 23 19:35:10.617474 2026] [:error] [pid 14573:tid 14597] [client 51.103.45.93:53987] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/settings.php"] [unique_id "acElbu-oSmHn3q4_J1HmXwAAAVY"]
[Mon Mar 23 19:35:11.233716 2026] [:error] [pid 57265:tid 57288] [client 51.103.45.93:55284] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sf.php"] [unique_id "acElb2NLjPJJkhuqCshoQwAAARU"]
[Mon Mar 23 19:35:11.756516 2026] [:error] [pid 23539:tid 23563] [client 51.103.45.93:54014] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sf.php"] [unique_id "acElb37Dh3qWGSpIAZUxVwAAAM8"]
[Mon Mar 23 19:35:12.465050 2026] [:error] [pid 14573:tid 14585] [client 51.103.45.93:28591] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sf.php"] [unique_id "acElcO-oSmHn3q4_J1HmYgAAAUo"]
[Mon Mar 23 19:35:13.336268 2026] [:error] [pid 23539:tid 23558] [client 51.103.45.93:43060] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sf.php"] [unique_id "acElcX7Dh3qWGSpIAZUxYAAAAMo"]
[Mon Mar 23 19:35:14.112405 2026] [:error] [pid 35165:tid 35174] [client 51.103.45.93:38393] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acElcs6udpN6Esk7JKvPJgAAAYY"]
[Mon Mar 23 19:35:15.051675 2026] [:error] [pid 23439:tid 23473] [client 51.103.45.93:43026] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acElc6Zv8XIzUKdgaMeZtwAAABg"]
[Mon Mar 23 19:35:16.049197 2026] [:error] [pid 14573:tid 14582] [client 51.103.45.93:64941] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acEldO-oSmHn3q4_J1HmawAAAUc"]
[Mon Mar 23 19:35:17.995707 2026] [:error] [pid 35165:tid 35168] [client 51.103.45.93:34927] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acEldc6udpN6Esk7JKvPLgAAAYA"]
[Mon Mar 23 19:35:19.941616 2026] [:error] [pid 35165:tid 35175] [client 51.103.45.93:43019] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "acEld86udpN6Esk7JKvPLwAAAYc"]
[Mon Mar 23 19:35:20.537663 2026] [:error] [pid 23440:tid 23477] [client 51.103.45.93:64921] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "acEleD49_8n8h_ttcUo-WwAAAEE"]
[Mon Mar 23 19:35:21.275792 2026] [:error] [pid 23441:tid 23513] [client 51.103.45.93:52731] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "acEleRq7S-oOqSXZEr7plAAAAIo"]
[Mon Mar 23 19:35:21.877634 2026] [:error] [pid 14573:tid 14596] [client 51.103.45.93:42691] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "acElee-oSmHn3q4_J1HmdAAAAVU"]
[Mon Mar 23 19:35:23.116671 2026] [:error] [pid 23441:tid 23504] [client 51.103.45.93:41808] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/w2025.php"] [unique_id "acElexq7S-oOqSXZEr7plQAAAIE"]
[Mon Mar 23 19:35:23.708792 2026] [:error] [pid 57265:tid 57282] [client 51.103.45.93:43052] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/w2025.php"] [unique_id "acEle2NLjPJJkhuqCshoSgAAAQ8"]
[Mon Mar 23 19:35:24.285308 2026] [:error] [pid 57265:tid 57272] [client 51.103.45.93:64925] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/w2025.php"] [unique_id "acElfGNLjPJJkhuqCshoTAAAAQU"]
[Mon Mar 23 19:35:24.804704 2026] [:error] [pid 14573:tid 14593] [client 51.103.45.93:43051] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/w2025.php"] [unique_id "acElfO-oSmHn3q4_J1HmewAAAVI"]
[Mon Mar 23 19:35:25.324914 2026] [:error] [pid 14573:tid 14584] [client 51.103.45.93:55282] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/swallowable.php"] [unique_id "acElfe-oSmHn3q4_J1HmfQAAAUk"]
[Mon Mar 23 19:35:26.016899 2026] [:error] [pid 23439:tid 23456] [client 51.103.45.93:52697] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/swallowable.php"] [unique_id "acElfqZv8XIzUKdgaMeZwQAAAAc"]
[Mon Mar 23 19:35:26.679599 2026] [:error] [pid 14573:tid 14581] [client 51.103.45.93:64901] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/swallowable.php"] [unique_id "acElfu-oSmHn3q4_J1HmfgAAAUY"]
[Mon Mar 23 19:35:27.488109 2026] [:error] [pid 23439:tid 23458] [client 51.103.45.93:42738] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/swallowable.php"] [unique_id "acElf6Zv8XIzUKdgaMeZxQAAAAk"]
[Mon Mar 23 19:35:28.193912 2026] [:error] [pid 23441:tid 23523] [client 51.103.45.93:42020] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fvvff.php"] [unique_id "acElgBq7S-oOqSXZEr7pmwAAAJQ"]
[Mon Mar 23 19:35:28.778945 2026] [:error] [pid 14573:tid 14592] [client 51.103.45.93:23856] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fvvff.php"] [unique_id "acElgO-oSmHn3q4_J1HmggAAAVE"]
[Mon Mar 23 19:35:29.321746 2026] [:error] [pid 57265:tid 57267] [client 51.103.45.93:34937] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fvvff.php"] [unique_id "acElgWNLjPJJkhuqCshoWQAAAQA"]
[Mon Mar 23 19:35:31.711789 2026] [:error] [pid 14573:tid 14587] [client 51.103.45.93:52718] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fvvff.php"] [unique_id "acElg--oSmHn3q4_J1HmigAAAUw"]
[Mon Mar 23 19:35:32.457462 2026] [:error] [pid 14573:tid 14576] [client 51.103.45.93:55247] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a2.php"] [unique_id "acElhO-oSmHn3q4_J1HmjAAAAUE"]
[Mon Mar 23 19:35:33.335076 2026] [:error] [pid 14573:tid 14578] [client 51.103.45.93:55273] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a2.php"] [unique_id "acElhe-oSmHn3q4_J1HmjQAAAUM"]
[Mon Mar 23 19:35:34.005194 2026] [:error] [pid 23439:tid 23450] [client 51.103.45.93:50296] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a2.php"] [unique_id "acElhqZv8XIzUKdgaMeZygAAAAE"]
[Mon Mar 23 19:35:34.718618 2026] [:error] [pid 35165:tid 35192] [client 51.103.45.93:34881] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a2.php"] [unique_id "acElhs6udpN6Esk7JKvPMwAAAZg"]
[Mon Mar 23 19:35:35.673608 2026] [:error] [pid 35165:tid 35179] [client 51.103.45.93:38369] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sty.php"] [unique_id "acElh86udpN6Esk7JKvPNQAAAYs"]
[Mon Mar 23 19:35:36.670082 2026] [:error] [pid 23539:tid 23563] [client 51.103.45.93:52716] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sty.php"] [unique_id "acEliH7Dh3qWGSpIAZUxbQAAAM8"]
[Mon Mar 23 19:35:37.583671 2026] [:error] [pid 14573:tid 14592] [client 51.103.45.93:41798] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sty.php"] [unique_id "acElie-oSmHn3q4_J1HmjwAAAVE"]
[Mon Mar 23 19:35:38.236190 2026] [:error] [pid 23439:tid 23460] [client 51.103.45.93:28577] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sty.php"] [unique_id "acEliqZv8XIzUKdgaMeZzgAAAAs"]
[Mon Mar 23 19:35:39.037679 2026] [:error] [pid 23439:tid 23452] [client 51.103.45.93:53972] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/txets.php"] [unique_id "acEli6Zv8XIzUKdgaMeZ0QAAAAM"]
[Mon Mar 23 19:35:40.118526 2026] [:error] [pid 23440:tid 23478] [client 51.103.45.93:43041] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/txets.php"] [unique_id "acEljD49_8n8h_ttcUo-XgAAAEI"]
[Mon Mar 23 19:35:40.758847 2026] [:error] [pid 23440:tid 23484] [client 51.103.45.93:23815] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/txets.php"] [unique_id "acEljD49_8n8h_ttcUo-YQAAAEg"]
[Mon Mar 23 19:35:41.365132 2026] [:error] [pid 14573:tid 14590] [client 51.103.45.93:52679] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/txets.php"] [unique_id "acElje-oSmHn3q4_J1HmkgAAAU8"]
[Mon Mar 23 19:35:42.200615 2026] [:error] [pid 57265:tid 57281] [client 51.103.45.93:34885] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acEljmNLjPJJkhuqCshoegAAAQ4"]
[Mon Mar 23 19:35:43.131832 2026] [:error] [pid 35165:tid 35186] [client 51.103.45.93:24198] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acElj86udpN6Esk7JKvPNwAAAZI"]
[Mon Mar 23 19:35:43.726871 2026] [:error] [pid 35165:tid 35178] [client 51.103.45.93:64923] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acElj86udpN6Esk7JKvPPAAAAYo"]
[Mon Mar 23 19:35:44.384410 2026] [:error] [pid 57265:tid 57286] [client 51.103.45.93:43039] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acElkGNLjPJJkhuqCshofgAAARM"]
[Mon Mar 23 19:35:45.100750 2026] [:error] [pid 14573:tid 14598] [client 51.103.45.93:38397] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acElke-oSmHn3q4_J1HmlQAAAVc"]
[Mon Mar 23 19:35:45.687970 2026] [:error] [pid 57265:tid 57287] [client 51.103.45.93:43063] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acElkWNLjPJJkhuqCshogAAAARQ"]
[Mon Mar 23 19:35:46.237485 2026] [:error] [pid 35165:tid 35168] [client 51.103.45.93:31637] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acElks6udpN6Esk7JKvPPQAAAYA"]
[Mon Mar 23 19:35:46.957147 2026] [:error] [pid 23440:tid 23489] [client 51.103.45.93:3544] [client 51.103.45.93] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acElkj49_8n8h_ttcUo-aAAAAE0"]
[Mon Mar 23 19:35:53.674350 2026] [:error] [pid 57265:tid 57285] [client 51.103.45.93:40997] [client 51.103.45.93] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 51.103.45.93, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acElmWNLjPJJkhuqCshoogAAARI"]
[Mon Mar 23 20:31:39.844015 2026] [:error] [pid 38178:tid 38250] [client 104.28.214.113:45074] [client 104.28.214.113] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/style.php"] [unique_id "acEyqw0axWfXsVvR9uc0FAAAAIg"]
[Mon Mar 23 21:16:59.219493 2026] [:error] [pid 38276:tid 38280] [client 103.69.111.52:58016] [client 103.69.111.52] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.69.111.52, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acE9S5oKGiI-a7oME3L2jgAAAME"]
[Mon Mar 23 23:55:24.147071 2026] [:error] [pid 38306:tid 38314] [client 40.85.222.197:7048] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acFibDkL8qwu-hHc6BjfbgAAAQY"]
[Mon Mar 23 23:55:24.558194 2026] [:error] [pid 38306:tid 38323] [client 40.85.222.197:7057] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acFibDkL8qwu-hHc6BjfcAAAAQ8"]
[Mon Mar 23 23:55:24.968303 2026] [:error] [pid 52341:tid 52353] [client 40.85.222.197:7067] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acFibKPKTBDR2u47Gb0yUAAAAUo"]
[Mon Mar 23 23:55:25.381954 2026] [:error] [pid 38306:tid 38324] [client 40.85.222.197:6557] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acFibTkL8qwu-hHc6BjfcgAAARA"]
[Mon Mar 23 23:55:25.793616 2026] [:error] [pid 52341:tid 52343] [client 40.85.222.197:6483] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/path.php"] [unique_id "acFibaPKTBDR2u47Gb0yVAAAAUA"]
[Mon Mar 23 23:55:26.204495 2026] [:error] [pid 38276:tid 38303] [client 40.85.222.197:6591] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/path.php"] [unique_id "acFibpoKGiI-a7oME3IgHwAAANg"]
[Mon Mar 23 23:55:26.620265 2026] [:error] [pid 38276:tid 38280] [client 40.85.222.197:6507] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/path.php"] [unique_id "acFibpoKGiI-a7oME3IgIAAAAME"]
[Mon Mar 23 23:55:27.031399 2026] [:error] [pid 38276:tid 38287] [client 40.85.222.197:6488] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wdf.php"] [unique_id "acFib5oKGiI-a7oME3IgJAAAAMg"]
[Mon Mar 23 23:55:27.450852 2026] [:error] [pid 38176:tid 38202] [client 40.85.222.197:6859] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wdf.php"] [unique_id "acFib0tG4qlh1gvNjuJtKAAAAA8"]
[Mon Mar 23 23:55:27.862675 2026] [:error] [pid 38176:tid 38190] [client 40.85.222.197:7065] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wdf.php"] [unique_id "acFib0tG4qlh1gvNjuJtKwAAAAM"]
[Mon Mar 23 23:55:28.272296 2026] [:error] [pid 52341:tid 52355] [client 40.85.222.197:7054] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wdf.php"] [unique_id "acFicKPKTBDR2u47Gb0yWAAAAUw"]
[Mon Mar 23 23:55:28.682969 2026] [:error] [pid 52341:tid 52357] [client 40.85.222.197:6513] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fleen.php"] [unique_id "acFicKPKTBDR2u47Gb0yWwAAAU4"]
[Mon Mar 23 23:55:29.093888 2026] [:error] [pid 52341:tid 52363] [client 40.85.222.197:6886] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fleen.php"] [unique_id "acFicaPKTBDR2u47Gb0yXwAAAVQ"]
[Mon Mar 23 23:55:29.509542 2026] [:error] [pid 38177:tid 38223] [client 40.85.222.197:6853] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fleen.php"] [unique_id "acFicXsYW-_HCI66MukOJQAAAEg"]
[Mon Mar 23 23:55:29.920503 2026] [:error] [pid 52341:tid 52354] [client 40.85.222.197:65350] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fleen.php"] [unique_id "acFicaPKTBDR2u47Gb0yYgAAAUs"]
[Mon Mar 23 23:55:30.345705 2026] [:error] [pid 38176:tid 38195] [client 40.85.222.197:6862] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-tem.php"] [unique_id "acFicktG4qlh1gvNjuJtNgAAAAg"]
[Mon Mar 23 23:55:30.757856 2026] [:error] [pid 38176:tid 38193] [client 40.85.222.197:65384] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-tem.php"] [unique_id "acFicktG4qlh1gvNjuJtPgAAAAY"]
[Mon Mar 23 23:55:31.168831 2026] [:error] [pid 38176:tid 38210] [client 40.85.222.197:65376] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-tem.php"] [unique_id "acFic0tG4qlh1gvNjuJtQQAAABc"]
[Mon Mar 23 23:55:31.595924 2026] [:error] [pid 38306:tid 38330] [client 40.85.222.197:6506] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-tem.php"] [unique_id "acFiczkL8qwu-hHc6BjfdwAAARY"]
[Mon Mar 23 23:55:32.006114 2026] [:error] [pid 38306:tid 38314] [client 40.85.222.197:6562] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/av6m.php"] [unique_id "acFidDkL8qwu-hHc6BjfegAAAQY"]
[Mon Mar 23 23:55:32.417333 2026] [:error] [pid 52341:tid 52361] [client 40.85.222.197:6881] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/av6m.php"] [unique_id "acFidKPKTBDR2u47Gb0yZAAAAVI"]
[Mon Mar 23 23:55:32.836582 2026] [:error] [pid 38306:tid 38329] [client 40.85.222.197:6582] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/av6m.php"] [unique_id "acFidDkL8qwu-hHc6BjffwAAARU"]
[Mon Mar 23 23:55:33.249435 2026] [:error] [pid 38306:tid 38325] [client 40.85.222.197:65367] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/av6m.php"] [unique_id "acFidTkL8qwu-hHc6BjfgAAAARE"]
[Mon Mar 23 23:55:33.675085 2026] [:error] [pid 38306:tid 38322] [client 40.85.222.197:7087] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/autogooey.php"] [unique_id "acFidTkL8qwu-hHc6BjfggAAAQ4"]
[Mon Mar 23 23:55:34.091545 2026] [:error] [pid 52341:tid 52363] [client 40.85.222.197:65389] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/btx25.php"] [unique_id "acFidqPKTBDR2u47Gb0ybgAAAVQ"]
[Mon Mar 23 23:55:34.502425 2026] [:error] [pid 38306:tid 38327] [client 40.85.222.197:6545] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/btx25.php"] [unique_id "acFidjkL8qwu-hHc6BjfgwAAARM"]
[Mon Mar 23 23:55:34.918936 2026] [:error] [pid 52341:tid 52354] [client 40.85.222.197:6511] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/btx25.php"] [unique_id "acFidqPKTBDR2u47Gb0ycQAAAUs"]
[Mon Mar 23 23:55:35.329378 2026] [:error] [pid 52341:tid 52352] [client 40.85.222.197:6482] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/btx25.php"] [unique_id "acFid6PKTBDR2u47Gb0ydgAAAUk"]
[Mon Mar 23 23:55:35.741361 2026] [:error] [pid 38177:tid 38233] [client 40.85.222.197:65389] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mga.php"] [unique_id "acFid3sYW-_HCI66MukOKgAAAFI"]
[Mon Mar 23 23:55:36.164924 2026] [:error] [pid 38276:tid 38290] [client 40.85.222.197:7059] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mga.php"] [unique_id "acFieJoKGiI-a7oME3IgKQAAAMs"]
[Mon Mar 23 23:55:36.575854 2026] [:error] [pid 38276:tid 38301] [client 40.85.222.197:6458] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mga.php"] [unique_id "acFieJoKGiI-a7oME3IgLAAAANY"]
[Mon Mar 23 23:55:36.988570 2026] [:error] [pid 38306:tid 38330] [client 40.85.222.197:6901] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mga.php"] [unique_id "acFieDkL8qwu-hHc6BjfhwAAARY"]
[Mon Mar 23 23:55:37.401063 2026] [:error] [pid 38306:tid 38332] [client 40.85.222.197:65402] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/maxro.php"] [unique_id "acFieTkL8qwu-hHc6BjfiAAAARg"]
[Mon Mar 23 23:55:37.812981 2026] [:error] [pid 38178:tid 38251] [client 40.85.222.197:6517] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/maxro.php"] [unique_id "acFieQ0axWfXsVvR9udhKQAAAIk"]
[Mon Mar 23 23:55:38.223800 2026] [:error] [pid 38306:tid 38328] [client 40.85.222.197:6535] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/maxro.php"] [unique_id "acFiejkL8qwu-hHc6BjfigAAARQ"]
[Mon Mar 23 23:55:38.640953 2026] [:error] [pid 38306:tid 38319] [client 40.85.222.197:6588] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/maxro.php"] [unique_id "acFiejkL8qwu-hHc6BjfjAAAAQs"]
[Mon Mar 23 23:55:39.060794 2026] [:error] [pid 38177:tid 38222] [client 40.85.222.197:7045] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/agg.php"] [unique_id "acFie3sYW-_HCI66MukOLAAAAEc"]
[Mon Mar 23 23:55:39.472494 2026] [:error] [pid 38306:tid 38317] [client 40.85.222.197:7040] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/agg.php"] [unique_id "acFiezkL8qwu-hHc6BjfkAAAAQk"]
[Mon Mar 23 23:55:39.893530 2026] [:error] [pid 38177:tid 38217] [client 40.85.222.197:7063] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/agg.php"] [unique_id "acFie3sYW-_HCI66MukOLgAAAEI"]
[Mon Mar 23 23:55:40.303036 2026] [:error] [pid 38176:tid 38206] [client 40.85.222.197:6905] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/agg.php"] [unique_id "acFifEtG4qlh1gvNjuJtRwAAABM"]
[Mon Mar 23 23:55:40.714107 2026] [:error] [pid 38306:tid 38318] [client 40.85.222.197:65375] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/pass4.php"] [unique_id "acFifDkL8qwu-hHc6BjflgAAAQo"]
[Mon Mar 23 23:55:41.131868 2026] [:error] [pid 38306:tid 38326] [client 40.85.222.197:65345] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/pass4.php"] [unique_id "acFifTkL8qwu-hHc6BjfmgAAARI"]
[Mon Mar 23 23:55:41.543219 2026] [:error] [pid 38177:tid 38234] [client 40.85.222.197:7103] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/pass4.php"] [unique_id "acFifXsYW-_HCI66MukOMgAAAFM"]
[Mon Mar 23 23:55:41.971427 2026] [:error] [pid 38178:tid 38255] [client 40.85.222.197:6532] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wsvvs.php"] [unique_id "acFifQ0axWfXsVvR9udhLwAAAI0"]
[Mon Mar 23 23:55:42.383182 2026] [:error] [pid 38178:tid 38253] [client 40.85.222.197:6525] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wsvvs.php"] [unique_id "acFifg0axWfXsVvR9udhMAAAAIs"]
[Mon Mar 23 23:55:42.794728 2026] [:error] [pid 38306:tid 38313] [client 40.85.222.197:7041] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wsvvs.php"] [unique_id "acFifjkL8qwu-hHc6BjfnQAAAQU"]
[Mon Mar 23 23:55:43.211528 2026] [:error] [pid 38177:tid 38236] [client 40.85.222.197:65396] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wsvvs.php"] [unique_id "acFif3sYW-_HCI66MukONgAAAFU"]
[Mon Mar 23 23:55:43.622157 2026] [:error] [pid 38276:tid 38297] [client 40.85.222.197:7100] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/G-In.php"] [unique_id "acFif5oKGiI-a7oME3IgOAAAANI"]
[Mon Mar 23 23:55:44.032661 2026] [:error] [pid 38306:tid 38311] [client 40.85.222.197:65355] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/G-In.php"] [unique_id "acFigDkL8qwu-hHc6BjfnwAAAQM"]
[Mon Mar 23 23:55:44.443027 2026] [:error] [pid 52341:tid 52356] [client 40.85.222.197:6849] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/G-In.php"] [unique_id "acFigKPKTBDR2u47Gb0yiQAAAU0"]
[Mon Mar 23 23:55:44.852909 2026] [:error] [pid 38176:tid 38204] [client 40.85.222.197:7046] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/G-In.php"] [unique_id "acFigEtG4qlh1gvNjuJtSwAAABE"]
[Mon Mar 23 23:55:45.262163 2026] [:error] [pid 38176:tid 38191] [client 40.85.222.197:6471] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/edit.php"] [unique_id "acFigUtG4qlh1gvNjuJtTAAAAAQ"]
[Mon Mar 23 23:55:45.673393 2026] [:error] [pid 52341:tid 52365] [client 40.85.222.197:65397] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/edit.php"] [unique_id "acFigaPKTBDR2u47Gb0yigAAAVY"]
[Mon Mar 23 23:55:46.088512 2026] [:error] [pid 38177:tid 38231] [client 40.85.222.197:6874] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/edit.php"] [unique_id "acFignsYW-_HCI66MukOOgAAAFA"]
[Mon Mar 23 23:55:46.500483 2026] [:error] [pid 52341:tid 52366] [client 40.85.222.197:7101] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/edit.php"] [unique_id "acFigqPKTBDR2u47Gb0yjAAAAVc"]
[Mon Mar 23 23:55:46.938898 2026] [:error] [pid 38306:tid 38330] [client 40.85.222.197:7058] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acFigjkL8qwu-hHc6BjfpwAAARY"]
[Mon Mar 23 23:55:47.350183 2026] [:error] [pid 52341:tid 52350] [client 40.85.222.197:6518] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acFig6PKTBDR2u47Gb0ykAAAAUc"]
[Mon Mar 23 23:55:47.764553 2026] [:error] [pid 38306:tid 38313] [client 40.85.222.197:6565] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acFigzkL8qwu-hHc6BjfrQAAAQU"]
[Mon Mar 23 23:55:48.208903 2026] [:error] [pid 38306:tid 38331] [client 40.85.222.197:6589] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acFihDkL8qwu-hHc6BjfrwAAARc"]
[Mon Mar 23 23:55:48.619723 2026] [:error] [pid 52341:tid 52355] [client 40.85.222.197:65370] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFihKPKTBDR2u47Gb0ylQAAAUw"]
[Mon Mar 23 23:55:49.033377 2026] [:error] [pid 52341:tid 52349] [client 40.85.222.197:6526] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFihaPKTBDR2u47Gb0ymQAAAUY"]
[Mon Mar 23 23:55:49.446124 2026] [:error] [pid 38176:tid 38204] [client 40.85.222.197:65394] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFihUtG4qlh1gvNjuJtVQAAABE"]
[Mon Mar 23 23:55:49.858142 2026] [:error] [pid 38177:tid 38233] [client 40.85.222.197:6863] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFihXsYW-_HCI66MukOOwAAAFI"]
[Mon Mar 23 23:55:50.268354 2026] [:error] [pid 38306:tid 38317] [client 40.85.222.197:6889] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/66.php"] [unique_id "acFihjkL8qwu-hHc6BjfsAAAAQk"]
[Mon Mar 23 23:55:50.679324 2026] [:error] [pid 38276:tid 38296] [client 40.85.222.197:6893] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/66.php"] [unique_id "acFihpoKGiI-a7oME3IgPgAAANE"]
[Mon Mar 23 23:55:51.093059 2026] [:error] [pid 38306:tid 38308] [client 40.85.222.197:65371] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/66.php"] [unique_id "acFihzkL8qwu-hHc6BjfswAAAQA"]
[Mon Mar 23 23:55:51.506704 2026] [:error] [pid 38306:tid 38325] [client 40.85.222.197:6496] [client 40.85.222.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/66.php"] [unique_id "acFihzkL8qwu-hHc6BjftAAAARE"]
[Tue Mar 24 01:03:10.616534 2026] [:error] [pid 56237:tid 56326] [client 40.85.246.124:57335] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acFyTgymO0MnzQb90MMfDQAAAIU"]
[Tue Mar 24 01:03:11.029103 2026] [:error] [pid 56435:tid 56500] [client 40.85.246.124:57305] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acFyT8rwr-l5A-s9ryBrbgAAAQE"]
[Tue Mar 24 01:03:11.448342 2026] [:error] [pid 56237:tid 56325] [client 40.85.246.124:57342] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acFyTwymO0MnzQb90MMfDgAAAIQ"]
[Tue Mar 24 01:03:11.866132 2026] [:error] [pid 56236:tid 56302] [client 40.85.246.124:56533] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acFyT3apFgYp0uZ8twAcgAAAAEk"]
[Tue Mar 24 01:03:12.278036 2026] [:error] [pid 56238:tid 56355] [client 40.85.246.124:57330] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/path.php"] [unique_id "acFyUFSqceFAZRgPDq6TTgAAAMc"]
[Tue Mar 24 01:03:12.698561 2026] [:error] [pid 56238:tid 56349] [client 40.85.246.124:56532] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/path.php"] [unique_id "acFyUFSqceFAZRgPDq6TUQAAAME"]
[Tue Mar 24 01:03:13.112438 2026] [:error] [pid 56237:tid 56340] [client 40.85.246.124:57325] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/path.php"] [unique_id "acFyUQymO0MnzQb90MMfFgAAAJM"]
[Tue Mar 24 01:03:13.527851 2026] [:error] [pid 56237:tid 56333] [client 40.85.246.124:57313] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/path.php"] [unique_id "acFyUQymO0MnzQb90MMfGQAAAIw"]
[Tue Mar 24 01:03:13.939953 2026] [:error] [pid 56238:tid 56369] [client 40.85.246.124:57307] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wdf.php"] [unique_id "acFyUVSqceFAZRgPDq6TWQAAANU"]
[Tue Mar 24 01:03:14.356160 2026] [:error] [pid 56238:tid 56363] [client 40.85.246.124:57326] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wdf.php"] [unique_id "acFyUlSqceFAZRgPDq6TWgAAAM8"]
[Tue Mar 24 01:03:14.777056 2026] [:error] [pid 56238:tid 56350] [client 40.85.246.124:57296] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wdf.php"] [unique_id "acFyUlSqceFAZRgPDq6TXAAAAMI"]
[Tue Mar 24 01:03:15.195988 2026] [:error] [pid 56237:tid 56327] [client 40.85.246.124:57311] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wdf.php"] [unique_id "acFyUwymO0MnzQb90MMfHAAAAIY"]
[Tue Mar 24 01:03:15.616020 2026] [:error] [pid 56236:tid 56297] [client 40.85.246.124:57291] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fleen.php"] [unique_id "acFyU3apFgYp0uZ8twAcjAAAAEQ"]
[Tue Mar 24 01:03:16.027582 2026] [:error] [pid 56237:tid 56326] [client 40.85.246.124:56512] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fleen.php"] [unique_id "acFyVAymO0MnzQb90MMfHgAAAIU"]
[Tue Mar 24 01:03:16.444029 2026] [:error] [pid 56237:tid 56343] [client 40.85.246.124:57304] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fleen.php"] [unique_id "acFyVAymO0MnzQb90MMfIgAAAJY"]
[Tue Mar 24 01:03:16.862402 2026] [:error] [pid 56238:tid 56352] [client 40.85.246.124:56518] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fleen.php"] [unique_id "acFyVFSqceFAZRgPDq6TXgAAAMQ"]
[Tue Mar 24 01:03:17.275097 2026] [:error] [pid 56236:tid 56296] [client 40.85.246.124:57339] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-tem.php"] [unique_id "acFyVXapFgYp0uZ8twAclAAAAEM"]
[Tue Mar 24 01:03:17.688768 2026] [:error] [pid 56237:tid 56334] [client 40.85.246.124:57301] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-tem.php"] [unique_id "acFyVQymO0MnzQb90MMfJwAAAI0"]
[Tue Mar 24 01:03:18.114255 2026] [:error] [pid 56237:tid 56332] [client 40.85.246.124:56537] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-tem.php"] [unique_id "acFyVgymO0MnzQb90MMfKAAAAIs"]
[Tue Mar 24 01:03:18.532473 2026] [:error] [pid 56238:tid 56370] [client 40.85.246.124:57288] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-tem.php"] [unique_id "acFyVlSqceFAZRgPDq6TYQAAANY"]
[Tue Mar 24 01:03:18.943871 2026] [:error] [pid 56238:tid 56354] [client 40.85.246.124:57310] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av6m.php"] [unique_id "acFyVlSqceFAZRgPDq6TYwAAAMY"]
[Tue Mar 24 01:03:19.357986 2026] [:error] [pid 56237:tid 56338] [client 40.85.246.124:56542] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av6m.php"] [unique_id "acFyVwymO0MnzQb90MMfKwAAAJE"]
[Tue Mar 24 01:03:19.771393 2026] [:error] [pid 56237:tid 56337] [client 40.85.246.124:57319] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av6m.php"] [unique_id "acFyVwymO0MnzQb90MMfLAAAAJA"]
[Tue Mar 24 01:03:20.185287 2026] [:error] [pid 56237:tid 56321] [client 40.85.246.124:57294] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av6m.php"] [unique_id "acFyWAymO0MnzQb90MMfLQAAAIA"]
[Tue Mar 24 01:03:20.599065 2026] [:error] [pid 56236:tid 56307] [client 40.85.246.124:56539] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/autogooey.php"] [unique_id "acFyWHapFgYp0uZ8twAcnQAAAE4"]
[Tue Mar 24 01:03:21.009707 2026] [:error] [pid 56236:tid 56296] [client 40.85.246.124:57334] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/autogooey.php"] [unique_id "acFyWXapFgYp0uZ8twAcoAAAAEM"]
[Tue Mar 24 01:03:21.421388 2026] [:error] [pid 56237:tid 56330] [client 40.85.246.124:56526] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/autogooey.php"] [unique_id "acFyWQymO0MnzQb90MMfNQAAAIk"]
[Tue Mar 24 01:03:21.849498 2026] [:error] [pid 56237:tid 56335] [client 40.85.246.124:56540] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/autogooey.php"] [unique_id "acFyWQymO0MnzQb90MMfOgAAAI4"]
[Tue Mar 24 01:03:22.264278 2026] [:error] [pid 56237:tid 56328] [client 40.85.246.124:57300] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/btx25.php"] [unique_id "acFyWgymO0MnzQb90MMfPQAAAIc"]
[Tue Mar 24 01:03:22.704050 2026] [:error] [pid 56236:tid 56315] [client 40.85.246.124:57340] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/btx25.php"] [unique_id "acFyWnapFgYp0uZ8twAcrgAAAFY"]
[Tue Mar 24 01:03:23.114808 2026] [:error] [pid 56435:tid 56499] [client 40.85.246.124:57336] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/btx25.php"] [unique_id "acFyW8rwr-l5A-s9ryBriQAAAQA"]
[Tue Mar 24 01:03:23.525573 2026] [:error] [pid 56237:tid 56331] [client 40.85.246.124:57285] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/btx25.php"] [unique_id "acFyWwymO0MnzQb90MMfRAAAAIo"]
[Tue Mar 24 01:03:23.938820 2026] [:error] [pid 56435:tid 56511] [client 40.85.246.124:57303] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mga.php"] [unique_id "acFyW8rwr-l5A-s9ryBriwAAAQs"]
[Tue Mar 24 01:03:24.353355 2026] [:error] [pid 56435:tid 56505] [client 40.85.246.124:57293] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mga.php"] [unique_id "acFyXMrwr-l5A-s9ryBrjQAAAQY"]
[Tue Mar 24 01:03:24.764973 2026] [:error] [pid 56435:tid 56508] [client 40.85.246.124:56523] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mga.php"] [unique_id "acFyXMrwr-l5A-s9ryBrjgAAAQg"]
[Tue Mar 24 01:03:25.177157 2026] [:error] [pid 56237:tid 56337] [client 40.85.246.124:12874] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mga.php"] [unique_id "acFyXQymO0MnzQb90MMfSAAAAJA"]
[Tue Mar 24 01:03:25.590507 2026] [:error] [pid 56435:tid 56504] [client 40.85.246.124:56516] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maxro.php"] [unique_id "acFyXcrwr-l5A-s9ryBrkgAAAQU"]
[Tue Mar 24 01:03:26.001677 2026] [:error] [pid 56238:tid 56355] [client 40.85.246.124:57308] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maxro.php"] [unique_id "acFyXlSqceFAZRgPDq6TawAAAMc"]
[Tue Mar 24 01:03:26.413425 2026] [:error] [pid 56435:tid 56501] [client 40.85.246.124:56547] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maxro.php"] [unique_id "acFyXsrwr-l5A-s9ryBrlQAAAQI"]
[Tue Mar 24 01:03:26.829831 2026] [:error] [pid 56237:tid 56326] [client 40.85.246.124:57323] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maxro.php"] [unique_id "acFyXgymO0MnzQb90MMfTAAAAIU"]
[Tue Mar 24 01:03:27.250970 2026] [:error] [pid 56435:tid 56513] [client 40.85.246.124:57324] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/agg.php"] [unique_id "acFyX8rwr-l5A-s9ryBrmQAAAQw"]
[Tue Mar 24 01:03:27.663470 2026] [:error] [pid 56238:tid 56370] [client 40.85.246.124:56536] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/agg.php"] [unique_id "acFyX1SqceFAZRgPDq6TcQAAANY"]
[Tue Mar 24 01:03:28.075782 2026] [:error] [pid 56238:tid 56361] [client 40.85.246.124:56564] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/agg.php"] [unique_id "acFyYFSqceFAZRgPDq6TcwAAAM0"]
[Tue Mar 24 01:03:28.488798 2026] [:error] [pid 56236:tid 56300] [client 40.85.246.124:12864] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/agg.php"] [unique_id "acFyYHapFgYp0uZ8twAczQAAAEc"]
[Tue Mar 24 01:03:28.904013 2026] [:error] [pid 56238:tid 56363] [client 40.85.246.124:57302] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/pass4.php"] [unique_id "acFyYFSqceFAZRgPDq6TdgAAAM8"]
[Tue Mar 24 01:03:29.317520 2026] [:error] [pid 56238:tid 56369] [client 40.85.246.124:57314] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/pass4.php"] [unique_id "acFyYVSqceFAZRgPDq6TdwAAANU"]
[Tue Mar 24 01:03:29.730490 2026] [:error] [pid 56237:tid 56332] [client 40.85.246.124:12873] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/pass4.php"] [unique_id "acFyYQymO0MnzQb90MMfTwAAAIs"]
[Tue Mar 24 01:03:30.144466 2026] [:error] [pid 56238:tid 56367] [client 40.85.246.124:56530] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/pass4.php"] [unique_id "acFyYlSqceFAZRgPDq6TeQAAANM"]
[Tue Mar 24 01:03:30.556739 2026] [:error] [pid 56238:tid 56370] [client 40.85.246.124:56572] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wsvvs.php"] [unique_id "acFyYlSqceFAZRgPDq6TfAAAANY"]
[Tue Mar 24 01:03:30.969465 2026] [:error] [pid 56238:tid 56349] [client 40.85.246.124:57328] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wsvvs.php"] [unique_id "acFyYlSqceFAZRgPDq6TfgAAAME"]
[Tue Mar 24 01:03:31.396697 2026] [:error] [pid 56237:tid 56337] [client 40.85.246.124:12900] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wsvvs.php"] [unique_id "acFyYwymO0MnzQb90MMfVAAAAJA"]
[Tue Mar 24 01:03:31.818922 2026] [:error] [pid 56237:tid 56324] [client 40.85.246.124:57316] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wsvvs.php"] [unique_id "acFyYwymO0MnzQb90MMfVgAAAIM"]
[Tue Mar 24 01:03:32.234312 2026] [:error] [pid 56435:tid 56505] [client 40.85.246.124:56515] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/G-In.php"] [unique_id "acFyZMrwr-l5A-s9ryBrnQAAAQY"]
[Tue Mar 24 01:03:32.646613 2026] [:error] [pid 56435:tid 56508] [client 40.85.246.124:56513] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/G-In.php"] [unique_id "acFyZMrwr-l5A-s9ryBrnwAAAQg"]
[Tue Mar 24 01:03:33.064592 2026] [:error] [pid 56435:tid 56522] [client 40.85.246.124:56528] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/G-In.php"] [unique_id "acFyZcrwr-l5A-s9ryBroAAAARU"]
[Tue Mar 24 01:03:33.486526 2026] [:error] [pid 56237:tid 56328] [client 40.85.246.124:12883] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/G-In.php"] [unique_id "acFyZQymO0MnzQb90MMfWQAAAIc"]
[Tue Mar 24 01:03:33.899821 2026] [:error] [pid 56236:tid 56304] [client 40.85.246.124:57332] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acFyZXapFgYp0uZ8twAc1gAAAEs"]
[Tue Mar 24 01:03:34.320702 2026] [:error] [pid 56236:tid 56296] [client 40.85.246.124:56525] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acFyZnapFgYp0uZ8twAc2QAAAEM"]
[Tue Mar 24 01:03:34.735245 2026] [:error] [pid 56435:tid 56518] [client 40.85.246.124:12879] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acFyZsrwr-l5A-s9ryBrowAAARE"]
[Tue Mar 24 01:03:35.146933 2026] [:error] [pid 56236:tid 56317] [client 40.85.246.124:57341] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acFyZ3apFgYp0uZ8twAc2wAAAFg"]
[Tue Mar 24 01:03:35.559695 2026] [:error] [pid 56237:tid 56336] [client 40.85.246.124:57321] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acFyZwymO0MnzQb90MMfXAAAAI8"]
[Tue Mar 24 01:03:35.987119 2026] [:error] [pid 56237:tid 56345] [client 40.85.246.124:57331] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acFyZwymO0MnzQb90MMfXgAAAJg"]
[Tue Mar 24 01:03:36.406485 2026] [:error] [pid 56435:tid 56502] [client 40.85.246.124:56535] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acFyaMrwr-l5A-s9ryBrqAAAAQM"]
[Tue Mar 24 01:03:36.824814 2026] [:error] [pid 56236:tid 56312] [client 40.85.246.124:12878] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acFyaHapFgYp0uZ8twAc3wAAAFM"]
[Tue Mar 24 01:03:37.238065 2026] [:error] [pid 56238:tid 56357] [client 40.85.246.124:57299] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFyaVSqceFAZRgPDq6TjAAAAMk"]
[Tue Mar 24 01:03:37.656077 2026] [:error] [pid 56237:tid 56325] [client 40.85.246.124:57306] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFyaQymO0MnzQb90MMfYgAAAIQ"]
[Tue Mar 24 01:03:38.065878 2026] [:error] [pid 56238:tid 56354] [client 40.85.246.124:12891] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFyalSqceFAZRgPDq6TjwAAAMY"]
[Tue Mar 24 01:03:38.480869 2026] [:error] [pid 56238:tid 56351] [client 40.85.246.124:56517] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acFyalSqceFAZRgPDq6TkgAAAMM"]
[Tue Mar 24 01:03:38.900040 2026] [:error] [pid 56435:tid 56520] [client 40.85.246.124:56546] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/66.php"] [unique_id "acFyasrwr-l5A-s9ryBrsQAAARM"]
[Tue Mar 24 01:03:39.318836 2026] [:error] [pid 56435:tid 56507] [client 40.85.246.124:56549] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/66.php"] [unique_id "acFya8rwr-l5A-s9ryBrtQAAAQc"]
[Tue Mar 24 01:03:39.735339 2026] [:error] [pid 56435:tid 56510] [client 40.85.246.124:56538] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/66.php"] [unique_id "acFya8rwr-l5A-s9ryBrtwAAAQo"]
[Tue Mar 24 01:03:40.184589 2026] [:error] [pid 56435:tid 56511] [client 40.85.246.124:56570] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/66.php"] [unique_id "acFybMrwr-l5A-s9ryBruwAAAQs"]
[Tue Mar 24 01:03:40.597621 2026] [:error] [pid 56237:tid 56333] [client 40.85.246.124:56524] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acFybAymO0MnzQb90MMfZAAAAIw"]
[Tue Mar 24 01:03:41.009303 2026] [:error] [pid 56237:tid 56322] [client 40.85.246.124:57295] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acFybQymO0MnzQb90MMfaQAAAIE"]
[Tue Mar 24 01:03:41.421572 2026] [:error] [pid 56237:tid 56334] [client 40.85.246.124:12917] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acFybQymO0MnzQb90MMfagAAAI0"]
[Tue Mar 24 01:03:41.833744 2026] [:error] [pid 56435:tid 56509] [client 40.85.246.124:12865] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/themes/inlite/"] [unique_id "acFybcrwr-l5A-s9ryBrvgAAAQk"]
[Tue Mar 24 01:03:42.247537 2026] [:error] [pid 56435:tid 56504] [client 40.85.246.124:12869] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acFybsrwr-l5A-s9ryBrwAAAAQU"]
[Tue Mar 24 01:03:42.658519 2026] [:error] [pid 56237:tid 56327] [client 40.85.246.124:56534] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acFybgymO0MnzQb90MMfbQAAAIY"]
[Tue Mar 24 01:03:43.074922 2026] [:error] [pid 56238:tid 56368] [client 40.85.246.124:57343] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acFyb1SqceFAZRgPDq6TnAAAANQ"]
[Tue Mar 24 01:03:43.487773 2026] [:error] [pid 56238:tid 56371] [client 40.85.246.124:12909] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acFyb1SqceFAZRgPDq6TnwAAANc"]
[Tue Mar 24 01:03:43.906844 2026] [:error] [pid 56238:tid 56366] [client 40.85.246.124:56555] [client 40.85.246.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "acFyb1SqceFAZRgPDq6TpAAAANI"]
[Tue Mar 24 01:03:44.318845 2026] [:error] [pid 56238:tid 56368] [client 40.85.246.124:57280] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acFycFSqceFAZRgPDq6TqAAAANQ"]
[Tue Mar 24 01:03:44.731166 2026] [:error] [pid 56238:tid 56359] [client 40.85.246.124:56569] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acFycFSqceFAZRgPDq6TrwAAAMs"]
[Tue Mar 24 01:03:45.146571 2026] [:error] [pid 56238:tid 56351] [client 40.85.246.124:56545] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/images/wp-conflg.php"] [unique_id "acFycVSqceFAZRgPDq6TsgAAAMM"]
[Tue Mar 24 01:03:45.560898 2026] [:error] [pid 56238:tid 56361] [client 40.85.246.124:12898] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acFycVSqceFAZRgPDq6TtQAAAM0"]
[Tue Mar 24 01:03:45.974100 2026] [:error] [pid 56236:tid 56299] [client 40.85.246.124:57312] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acFycXapFgYp0uZ8twAc7gAAAEY"]
[Tue Mar 24 01:03:46.390574 2026] [:error] [pid 56238:tid 56359] [client 40.85.246.124:56521] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acFyclSqceFAZRgPDq6TvgAAAMs"]
[Tue Mar 24 01:03:46.807783 2026] [:error] [pid 56237:tid 56330] [client 40.85.246.124:12886] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "acFycgymO0MnzQb90MMfcQAAAIk"]
[Tue Mar 24 01:03:47.225092 2026] [:error] [pid 56237:tid 56333] [client 40.85.246.124:12890] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/assets/css/index.php"] [unique_id "acFycwymO0MnzQb90MMfdQAAAIw"]
[Tue Mar 24 01:03:47.644037 2026] [:error] [pid 56236:tid 56315] [client 40.85.246.124:12871] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/assets/css/index.php"] [unique_id "acFyc3apFgYp0uZ8twAc8wAAAFY"]
[Tue Mar 24 01:03:48.055980 2026] [:error] [pid 56236:tid 56309] [client 40.85.246.124:57281] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/assets/css/index.php"] [unique_id "acFydHapFgYp0uZ8twAc-AAAAFA"]
[Tue Mar 24 01:03:48.473872 2026] [:error] [pid 56435:tid 56520] [client 40.85.246.124:56574] [client 40.85.246.124] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/assets/css/index.php"] [unique_id "acFydMrwr-l5A-s9ryBr0AAAARM"]
[Tue Mar 24 09:02:44.795474 2026] [:error] [pid 38767:tid 38778] [client 185.223.152.132:61685] [client 185.223.152.132] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.132, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acHitPwkUqN4GJAI5oXAGQAAAQg"]
[Tue Mar 24 17:59:59.506271 2026] [:error] [pid 48219:tid 48297] [client 103.117.162.224:54574] [client 103.117.162.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.117.162.224, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acJgnyhf3b4R_lAIyv9dPwAAAhA"]
[Tue Mar 24 20:48:08.795430 2026] [:error] [pid 38767:tid 38790] [client 20.63.12.125:10738] [client 20.63.12.125] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.63.12.125, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acKICPwkUqN4GJAI5oVCHgAAARQ"]
[Tue Mar 24 20:48:10.700108 2026] [:error] [pid 38767:tid 38775] [client 20.63.12.125:10738] [client 20.63.12.125] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.63.12.125, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acKICvwkUqN4GJAI5oVCNQAAAQU"]
[Tue Mar 24 20:48:14.087668 2026] [:error] [pid 38767:tid 38779] [client 20.63.12.125:10738] [client 20.63.12.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "acKIDvwkUqN4GJAI5oVCSQAAAQk"]
[Tue Mar 24 23:09:48.145623 2026] [:error] [pid 3137:tid 3157] [client 216.81.245.214:60706] [client 216.81.245.214] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "acKpPJdZesutm6dfYM9jMAAAANI"]
[Tue Mar 24 23:10:46.865348 2026] [:error] [pid 64198:tid 64216] [client 103.152.100.86:6094] [client 103.152.100.86] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.152.100.86, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acKpdnVzJqf6OS_oSZ3q5gAAAVA"]
[Tue Mar 24 23:29:09.150883 2026] [:error] [pid 64198:tid 64203] [client 158.158.52.11:26757] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/buc.php"] [unique_id "acKtxXVzJqf6OS_oSZ3wLgAAAUM"]
[Tue Mar 24 23:29:10.265518 2026] [:error] [pid 48214:tid 48257] [client 158.158.52.11:30090] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/buc.php"] [unique_id "acKtxreshLWZ3uUDHKmJLwAAAcU"]
[Tue Mar 24 23:29:11.144548 2026] [:error] [pid 38767:tid 38776] [client 158.158.52.11:23547] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/buc.php"] [unique_id "acKtx_wkUqN4GJAI5oV8GwAAAQY"]
[Tue Mar 24 23:29:14.188498 2026] [:error] [pid 64198:tid 64201] [client 158.158.52.11:2733] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/buc.php"] [unique_id "acKtynVzJqf6OS_oSZ3wMAAAAUE"]
[Tue Mar 24 23:29:14.981333 2026] [:error] [pid 3137:tid 3146] [client 158.158.52.11:20257] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ww.php"] [unique_id "acKtypdZesutm6dfYM9riwAAAMc"]
[Tue Mar 24 23:29:16.477276 2026] [:error] [pid 3137:tid 3162] [client 158.158.52.11:19314] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ww.php"] [unique_id "acKtzJdZesutm6dfYM9rkwAAANc"]
[Tue Mar 24 23:29:17.645602 2026] [:error] [pid 38767:tid 38793] [client 158.158.52.11:18983] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ww.php"] [unique_id "acKtzfwkUqN4GJAI5oV8IAAAARc"]
[Tue Mar 24 23:29:18.382080 2026] [:error] [pid 64198:tid 64224] [client 158.158.52.11:22980] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ww.php"] [unique_id "acKtznVzJqf6OS_oSZ3wMwAAAVg"]
[Tue Mar 24 23:29:19.271142 2026] [:error] [pid 48214:tid 48269] [client 158.158.52.11:13817] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/rithin.php"] [unique_id "acKtz7eshLWZ3uUDHKmJNQAAAdE"]
[Tue Mar 24 23:29:20.185495 2026] [:error] [pid 3137:tid 3155] [client 158.158.52.11:19304] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/rithin.php"] [unique_id "acKt0JdZesutm6dfYM9rmAAAANA"]
[Tue Mar 24 23:29:20.782277 2026] [:error] [pid 3137:tid 3139] [client 158.158.52.11:20232] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/rithin.php"] [unique_id "acKt0JdZesutm6dfYM9rmgAAAMA"]
[Tue Mar 24 23:29:21.542955 2026] [:error] [pid 3137:tid 3152] [client 158.158.52.11:29971] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/rithin.php"] [unique_id "acKt0ZdZesutm6dfYM9rnAAAAM0"]
[Tue Mar 24 23:29:22.318625 2026] [:error] [pid 64198:tid 64223] [client 158.158.52.11:21182] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/as.php"] [unique_id "acKt0nVzJqf6OS_oSZ3wNgAAAVc"]
[Tue Mar 24 23:29:22.947039 2026] [:error] [pid 38767:tid 38775] [client 158.158.52.11:27572] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/as.php"] [unique_id "acKt0vwkUqN4GJAI5oV8KQAAAQU"]
[Tue Mar 24 23:29:23.834527 2026] [:error] [pid 38767:tid 38785] [client 158.158.52.11:30124] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/as.php"] [unique_id "acKt0_wkUqN4GJAI5oV8LQAAAQ8"]
[Tue Mar 24 23:29:24.594995 2026] [:error] [pid 3137:tid 3145] [client 158.158.52.11:23016] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/as.php"] [unique_id "acKt1JdZesutm6dfYM9roQAAAMY"]
[Tue Mar 24 23:29:25.720131 2026] [:error] [pid 38767:tid 38779] [client 158.158.52.11:19729] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acKt1fwkUqN4GJAI5oV8MAAAAQk"]
[Tue Mar 24 23:29:26.594501 2026] [:error] [pid 64198:tid 64205] [client 158.158.52.11:29988] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acKt1nVzJqf6OS_oSZ3wNwAAAUU"]
[Tue Mar 24 23:29:27.384094 2026] [:error] [pid 38767:tid 38790] [client 158.158.52.11:17127] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acKt1_wkUqN4GJAI5oV8MgAAARQ"]
[Tue Mar 24 23:29:27.938499 2026] [:error] [pid 64198:tid 64202] [client 158.158.52.11:23505] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acKt13VzJqf6OS_oSZ3wOAAAAUI"]
[Tue Mar 24 23:29:28.972423 2026] [:error] [pid 64198:tid 64218] [client 158.158.52.11:13797] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acKt2HVzJqf6OS_oSZ3wOgAAAVI"]
[Tue Mar 24 23:29:29.862767 2026] [:error] [pid 3137:tid 3146] [client 158.158.52.11:30005] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acKt2ZdZesutm6dfYM9ruAAAAMc"]
[Tue Mar 24 23:29:30.930669 2026] [:error] [pid 3137:tid 3139] [client 158.158.52.11:24259] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acKt2pdZesutm6dfYM9rvAAAAMA"]
[Tue Mar 24 23:29:31.748045 2026] [:error] [pid 3137:tid 3156] [client 158.158.52.11:18743] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acKt25dZesutm6dfYM9rvgAAANE"]
[Tue Mar 24 23:29:32.444406 2026] [:error] [pid 48128:tid 48174] [client 158.158.52.11:18532] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acKt3MvR4LIMFLbM5VlJDAAAAZU"]
[Tue Mar 24 23:29:33.162806 2026] [:error] [pid 3030:tid 3057] [client 158.158.52.11:27534] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acKt3QyOuILyynfcqflyKQAAAAg"]
[Tue Mar 24 23:29:33.897076 2026] [:error] [pid 38767:tid 38788] [client 158.158.52.11:14747] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acKt3fwkUqN4GJAI5oV8NwAAARI"]
[Tue Mar 24 23:29:35.041356 2026] [:error] [pid 38767:tid 38773] [client 158.158.52.11:30118] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acKt3_wkUqN4GJAI5oV8PQAAAQM"]
[Tue Mar 24 23:29:36.133536 2026] [:error] [pid 64198:tid 64214] [client 158.158.52.11:19309] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acKt4HVzJqf6OS_oSZ3wQgAAAU4"]
[Tue Mar 24 23:29:38.429878 2026] [:error] [pid 3137:tid 3141] [client 158.158.52.11:18787] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acKt4pdZesutm6dfYM9rwQAAAMI"]
[Tue Mar 24 23:29:39.371893 2026] [:error] [pid 48219:tid 48299] [client 158.158.52.11:21176] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acKt4yhf3b4R_lAIyv-lzgAAAhI"]
[Tue Mar 24 23:29:40.289561 2026] [:error] [pid 3137:tid 3157] [client 158.158.52.11:23005] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acKt5JdZesutm6dfYM9rywAAANI"]
[Tue Mar 24 23:29:41.479124 2026] [:error] [pid 3137:tid 3151] [client 158.158.52.11:26359] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acKt5ZdZesutm6dfYM9r0AAAAMw"]
[Tue Mar 24 23:29:42.031383 2026] [:error] [pid 3137:tid 3153] [client 158.158.52.11:29162] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acKt5pdZesutm6dfYM9r0wAAAM4"]
[Tue Mar 24 23:29:42.612418 2026] [:error] [pid 3031:tid 3093] [client 158.158.52.11:23511] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acKt5qJBKytnG47nuiZF9AAAAFE"]
[Tue Mar 24 23:29:43.753145 2026] [:error] [pid 3031:tid 3085] [client 158.158.52.11:27531] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acKt56JBKytnG47nuiZF-AAAAEk"]
[Tue Mar 24 23:29:45.039075 2026] [:error] [pid 3137:tid 3155] [client 158.158.52.11:19287] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/h2.php"] [unique_id "acKt6ZdZesutm6dfYM9r5gAAANA"]
[Tue Mar 24 23:29:45.946449 2026] [:error] [pid 48214:tid 48266] [client 158.158.52.11:26333] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/h2.php"] [unique_id "acKt6beshLWZ3uUDHKmJQQAAAc4"]
[Tue Mar 24 23:29:47.015794 2026] [:error] [pid 64198:tid 64202] [client 158.158.52.11:31185] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/h2.php"] [unique_id "acKt63VzJqf6OS_oSZ3wSQAAAUI"]
[Tue Mar 24 23:29:47.756120 2026] [:error] [pid 3032:tid 3108] [client 158.158.52.11:20230] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/h2.php"] [unique_id "acKt6ya_-JXXD03-JNxtLAAAAIU"]
[Tue Mar 24 23:29:48.717001 2026] [:error] [pid 64198:tid 64215] [client 158.158.52.11:19276] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/dass.php"] [unique_id "acKt7HVzJqf6OS_oSZ3wTgAAAU8"]
[Tue Mar 24 23:29:50.339518 2026] [:error] [pid 64198:tid 64214] [client 158.158.52.11:26351] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/dass.php"] [unique_id "acKt7nVzJqf6OS_oSZ3wUQAAAU4"]
[Tue Mar 24 23:29:50.998994 2026] [:error] [pid 3032:tid 3104] [client 158.158.52.11:23247] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/dass.php"] [unique_id "acKt7ia_-JXXD03-JNxtMAAAAIE"]
[Tue Mar 24 23:29:52.044216 2026] [:error] [pid 64198:tid 64222] [client 158.158.52.11:2694] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/dass.php"] [unique_id "acKt8HVzJqf6OS_oSZ3wVAAAAVY"]
[Tue Mar 24 23:29:52.759339 2026] [:error] [pid 64198:tid 64208] [client 158.158.52.11:29957] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/s.php"] [unique_id "acKt8HVzJqf6OS_oSZ3wVgAAAUg"]
[Tue Mar 24 23:29:53.676012 2026] [:error] [pid 64198:tid 64213] [client 158.158.52.11:2699] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/s.php"] [unique_id "acKt8XVzJqf6OS_oSZ3wWAAAAU0"]
[Tue Mar 24 23:29:54.726714 2026] [:error] [pid 3031:tid 3099] [client 158.158.52.11:17617] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/s.php"] [unique_id "acKt8qJBKytnG47nuiZF_AAAAFc"]
[Tue Mar 24 23:29:56.083922 2026] [:error] [pid 48214:tid 48269] [client 158.158.52.11:30243] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/s.php"] [unique_id "acKt9LeshLWZ3uUDHKmJTwAAAdE"]
[Tue Mar 24 23:29:57.131282 2026] [:error] [pid 3137:tid 3144] [client 158.158.52.11:11910] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/kj.php"] [unique_id "acKt9ZdZesutm6dfYM9sGgAAAMU"]
[Tue Mar 24 23:29:57.970292 2026] [:error] [pid 64198:tid 64205] [client 158.158.52.11:18519] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/kj.php"] [unique_id "acKt9XVzJqf6OS_oSZ3wWwAAAUU"]
[Tue Mar 24 23:29:59.061767 2026] [:error] [pid 64198:tid 64219] [client 158.158.52.11:20231] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/kj.php"] [unique_id "acKt93VzJqf6OS_oSZ3wYgAAAVM"]
[Tue Mar 24 23:29:59.737168 2026] [:error] [pid 3030:tid 3063] [client 158.158.52.11:22701] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/kj.php"] [unique_id "acKt9wyOuILyynfcqflyOQAAAA4"]
[Tue Mar 24 23:30:00.362907 2026] [:error] [pid 48214:tid 48271] [client 158.158.52.11:11006] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws83.php"] [unique_id "acKt-LeshLWZ3uUDHKmJWQAAAdM"]
[Tue Mar 24 23:30:01.107852 2026] [:error] [pid 48128:tid 48162] [client 158.158.52.11:18462] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws83.php"] [unique_id "acKt-cvR4LIMFLbM5VlJEAAAAYo"]
[Tue Mar 24 23:30:02.092828 2026] [:error] [pid 3031:tid 3081] [client 158.158.52.11:26786] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws83.php"] [unique_id "acKt-qJBKytnG47nuiZGKwAAAEU"]
[Tue Mar 24 23:30:04.421274 2026] [:error] [pid 3137:tid 3144] [client 158.158.52.11:18813] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws83.php"] [unique_id "acKt_JdZesutm6dfYM9sTQAAAMU"]
[Tue Mar 24 23:30:05.547086 2026] [:error] [pid 3030:tid 3072] [client 158.158.52.11:22663] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws75.php"] [unique_id "acKt_QyOuILyynfcqflyPQAAABc"]
[Tue Mar 24 23:30:06.547013 2026] [:error] [pid 38767:tid 38775] [client 158.158.52.11:18813] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws75.php"] [unique_id "acKt_vwkUqN4GJAI5oV8UQAAAQU"]
[Tue Mar 24 23:30:07.368668 2026] [:error] [pid 3031:tid 3082] [client 158.158.52.11:11722] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws75.php"] [unique_id "acKt_6JBKytnG47nuiZGMAAAAEY"]
[Tue Mar 24 23:30:23.952825 2026] [:error] [pid 3031:tid 3094] [client 158.158.52.11:18465] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/ws49.php"] [unique_id "acKuD6JBKytnG47nuiZGPgAAAFI"]
[Tue Mar 24 23:30:25.044582 2026] [:error] [pid 3030:tid 3058] [client 158.158.52.11:26842] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/ws49.php"] [unique_id "acKuEQyOuILyynfcqflyRQAAAAk"]
[Tue Mar 24 23:30:25.749332 2026] [:error] [pid 64198:tid 64222] [client 158.158.52.11:16623] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/ws49.php"] [unique_id "acKuEXVzJqf6OS_oSZ3wlwAAAVY"]
[Tue Mar 24 23:30:27.256610 2026] [:error] [pid 3032:tid 3106] [client 158.158.52.11:23214] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/ws49.php"] [unique_id "acKuEya_-JXXD03-JNxtPgAAAIM"]
[Tue Mar 24 23:30:29.225866 2026] [:error] [pid 48214:tid 48263] [client 158.158.52.11:16282] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acKuFbeshLWZ3uUDHKmJawAAAcs"]
[Tue Mar 24 23:30:30.878432 2026] [:error] [pid 48219:tid 48286] [client 158.158.52.11:16296] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acKuFihf3b4R_lAIyv-l5gAAAgU"]
[Tue Mar 24 23:30:31.765444 2026] [:error] [pid 64198:tid 64224] [client 158.158.52.11:21943] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acKuF3VzJqf6OS_oSZ3wnwAAAVg"]
[Tue Mar 24 23:30:34.363614 2026] [:error] [pid 3030:tid 3059] [client 158.158.52.11:28287] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acKuGgyOuILyynfcqflyTgAAAAo"]
[Tue Mar 24 23:30:35.025475 2026] [:error] [pid 3032:tid 3104] [client 158.158.52.11:16301] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sa.php7"] [unique_id "acKuGya_-JXXD03-JNxtTAAAAIE"]
[Tue Mar 24 23:30:36.398557 2026] [:error] [pid 3030:tid 3064] [client 158.158.52.11:2844] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sa.php7"] [unique_id "acKuHAyOuILyynfcqflyTwAAAA8"]
[Tue Mar 24 23:30:37.745806 2026] [:error] [pid 3032:tid 3127] [client 158.158.52.11:17360] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sa.php7"] [unique_id "acKuHSa_-JXXD03-JNxtUQAAAJc"]
[Tue Mar 24 23:30:38.432794 2026] [:error] [pid 48219:tid 48288] [client 158.158.52.11:29643] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sa.php7"] [unique_id "acKuHihf3b4R_lAIyv-l6gAAAgc"]
[Tue Mar 24 23:30:40.034268 2026] [:error] [pid 38767:tid 38772] [client 158.158.52.11:2858] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/jp.php"] [unique_id "acKuIPwkUqN4GJAI5oV8hwAAAQI"]
[Tue Mar 24 23:30:40.618378 2026] [:error] [pid 48219:tid 48295] [client 158.158.52.11:27000] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/jp.php"] [unique_id "acKuIChf3b4R_lAIyv-l7gAAAg4"]
[Tue Mar 24 23:30:41.538782 2026] [:error] [pid 48219:tid 48291] [client 158.158.52.11:29576] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/jp.php"] [unique_id "acKuIShf3b4R_lAIyv-l8QAAAgo"]
[Tue Mar 24 23:30:47.373974 2026] [:error] [pid 3137:tid 3155] [client 158.158.52.11:18069] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/jp.php"] [unique_id "acKuJ5dZesutm6dfYM9sjQAAANA"]
[Tue Mar 24 23:30:49.068098 2026] [:error] [pid 3030:tid 3050] [client 158.158.52.11:2951] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-good.php"] [unique_id "acKuKQyOuILyynfcqflyWQAAAAE"]
[Tue Mar 24 23:30:51.567889 2026] [:error] [pid 64198:tid 64207] [client 158.158.52.11:2960] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-good.php"] [unique_id "acKuK3VzJqf6OS_oSZ3wrAAAAUc"]
[Tue Mar 24 23:30:52.627573 2026] [:error] [pid 3031:tid 3098] [client 158.158.52.11:16807] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-good.php"] [unique_id "acKuLKJBKytnG47nuiZGRgAAAFY"]
[Tue Mar 24 23:30:53.754970 2026] [:error] [pid 3031:tid 3093] [client 158.158.52.11:28226] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-good.php"] [unique_id "acKuLaJBKytnG47nuiZGSAAAAFE"]
[Tue Mar 24 23:30:55.392708 2026] [:error] [pid 3030:tid 3053] [client 158.158.52.11:16847] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a5.php"] [unique_id "acKuLwyOuILyynfcqflyXgAAAAQ"]
[Tue Mar 24 23:30:56.708877 2026] [:error] [pid 3137:tid 3157] [client 158.158.52.11:31261] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a5.php"] [unique_id "acKuMJdZesutm6dfYM9smAAAANI"]
[Tue Mar 24 23:30:57.472825 2026] [:error] [pid 48214:tid 48264] [client 158.158.52.11:17898] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a5.php"] [unique_id "acKuMbeshLWZ3uUDHKmJkAAAAcw"]
[Tue Mar 24 23:31:00.172587 2026] [:error] [pid 64198:tid 64215] [client 158.158.52.11:29616] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a5.php"] [unique_id "acKuNHVzJqf6OS_oSZ3wtQAAAU8"]
[Tue Mar 24 23:31:00.979304 2026] [:error] [pid 3030:tid 3070] [client 158.158.52.11:2994] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amp.php"] [unique_id "acKuNAyOuILyynfcqflyYQAAABU"]
[Tue Mar 24 23:31:02.201258 2026] [:error] [pid 48219:tid 48296] [client 158.158.52.11:13473] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amp.php"] [unique_id "acKuNihf3b4R_lAIyv-mAwAAAg8"]
[Tue Mar 24 23:31:02.916102 2026] [:error] [pid 38767:tid 38778] [client 158.158.52.11:13481] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amp.php"] [unique_id "acKuNvwkUqN4GJAI5oV8jwAAAQg"]
[Tue Mar 24 23:31:03.567436 2026] [:error] [pid 3137:tid 3153] [client 158.158.52.11:20406] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amp.php"] [unique_id "acKuN5dZesutm6dfYM9soQAAAM4"]
[Tue Mar 24 23:31:05.006498 2026] [:error] [pid 3137:tid 3140] [client 158.158.52.11:17872] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/init.php"] [unique_id "acKuOZdZesutm6dfYM9spgAAAME"]
[Tue Mar 24 23:31:05.873143 2026] [:error] [pid 48214:tid 48256] [client 158.158.52.11:20352] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/init.php"] [unique_id "acKuObeshLWZ3uUDHKmJmwAAAcQ"]
[Tue Mar 24 23:31:06.993830 2026] [:error] [pid 48214:tid 48252] [client 158.158.52.11:26881] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/init.php"] [unique_id "acKuOreshLWZ3uUDHKmJoQAAAcA"]
[Tue Mar 24 23:31:07.874710 2026] [:error] [pid 3137:tid 3146] [client 158.158.52.11:16802] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/init.php"] [unique_id "acKuO5dZesutm6dfYM9srQAAAMc"]
[Tue Mar 24 23:31:08.885612 2026] [:error] [pid 3137:tid 3140] [client 158.158.52.11:18222] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gettest.php"] [unique_id "acKuPJdZesutm6dfYM9sswAAAME"]
[Tue Mar 24 23:31:10.221499 2026] [:error] [pid 3137:tid 3161] [client 158.158.52.11:29604] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gettest.php"] [unique_id "acKuPpdZesutm6dfYM9swQAAANY"]
[Tue Mar 24 23:31:11.529302 2026] [:error] [pid 3032:tid 3105] [client 158.158.52.11:29585] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gettest.php"] [unique_id "acKuPya_-JXXD03-JNxtWgAAAII"]
[Tue Mar 24 23:31:13.252772 2026] [:error] [pid 48219:tid 48302] [client 158.158.52.11:28423] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gettest.php"] [unique_id "acKuQShf3b4R_lAIyv-mDAAAAhU"]
[Tue Mar 24 23:31:14.478419 2026] [:error] [pid 48219:tid 48300] [client 158.158.52.11:18281] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/myfile.php"] [unique_id "acKuQihf3b4R_lAIyv-mDwAAAhM"]
[Tue Mar 24 23:31:15.505448 2026] [:error] [pid 48219:tid 48286] [client 158.158.52.11:20386] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/myfile.php"] [unique_id "acKuQyhf3b4R_lAIyv-mEwAAAgU"]
[Tue Mar 24 23:31:16.515595 2026] [:error] [pid 3032:tid 3112] [client 158.158.52.11:26943] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/myfile.php"] [unique_id "acKuRCa_-JXXD03-JNxtYQAAAIk"]
[Tue Mar 24 23:31:18.960019 2026] [:error] [pid 48214:tid 48267] [client 158.158.52.11:23263] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/myfile.php"] [unique_id "acKuRreshLWZ3uUDHKmJswAAAc8"]
[Tue Mar 24 23:31:19.852458 2026] [:error] [pid 38767:tid 38771] [client 158.158.52.11:24478] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sid3.php"] [unique_id "acKuR_wkUqN4GJAI5oV8lwAAAQE"]
[Tue Mar 24 23:31:20.878282 2026] [:error] [pid 3030:tid 3072] [client 158.158.52.11:2106] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sid3.php"] [unique_id "acKuSAyOuILyynfcqflyaAAAABc"]
[Tue Mar 24 23:31:38.903404 2026] [:error] [pid 48214:tid 48254] [client 158.158.52.11:21641] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/install.php"] [unique_id "acKuWreshLWZ3uUDHKmJyAAAAcI"]
[Tue Mar 24 23:31:39.645429 2026] [:error] [pid 3137:tid 3155] [client 158.158.52.11:18187] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/install.php"] [unique_id "acKuW5dZesutm6dfYM9s-QAAANA"]
[Tue Mar 24 23:31:41.444527 2026] [:error] [pid 3137:tid 3143] [client 158.158.52.11:20375] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/install.php"] [unique_id "acKuXZdZesutm6dfYM9tAgAAAMQ"]
[Tue Mar 24 23:31:42.690935 2026] [:error] [pid 3030:tid 3066] [client 158.158.52.11:18257] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/install.php"] [unique_id "acKuXgyOuILyynfcqflydQAAABE"]
[Tue Mar 24 23:31:43.800780 2026] [:error] [pid 48219:tid 48303] [client 158.158.52.11:21470] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acKuXyhf3b4R_lAIyv-mKwAAAhY"]
[Tue Mar 24 23:31:45.142723 2026] [:error] [pid 3137:tid 3152] [client 158.158.52.11:29536] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acKuYZdZesutm6dfYM9tDgAAAM0"]
[Tue Mar 24 23:31:46.144170 2026] [:error] [pid 38767:tid 38778] [client 158.158.52.11:20228] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acKuYvwkUqN4GJAI5oV80gAAAQg"]
[Tue Mar 24 23:31:47.193906 2026] [:error] [pid 38767:tid 38770] [client 158.158.52.11:26916] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acKuY_wkUqN4GJAI5oV82AAAAQA"]
[Tue Mar 24 23:31:47.732512 2026] [:error] [pid 48214:tid 48257] [client 158.158.52.11:23264] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nw.php"] [unique_id "acKuY7eshLWZ3uUDHKmJywAAAcU"]
[Tue Mar 24 23:31:48.508184 2026] [:error] [pid 48214:tid 48267] [client 158.158.52.11:29554] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nw.php"] [unique_id "acKuZLeshLWZ3uUDHKmJ0AAAAc8"]
[Tue Mar 24 23:31:49.552658 2026] [:error] [pid 38767:tid 38787] [client 158.158.52.11:2110] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nw.php"] [unique_id "acKuZfwkUqN4GJAI5oV84gAAARE"]
[Tue Mar 24 23:31:50.506950 2026] [:error] [pid 38767:tid 38776] [client 158.158.52.11:18201] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nw.php"] [unique_id "acKuZvwkUqN4GJAI5oV85gAAAQY"]
[Tue Mar 24 23:31:52.391941 2026] [:error] [pid 3137:tid 3160] [client 158.158.52.11:2092] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tool.php"] [unique_id "acKuaJdZesutm6dfYM9tJQAAANU"]
[Tue Mar 24 23:31:55.089671 2026] [:error] [pid 48128:tid 48161] [client 158.158.52.11:29559] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tool.php"] [unique_id "acKua8vR4LIMFLbM5VlJYgAAAYk"]
[Tue Mar 24 23:31:56.049144 2026] [:error] [pid 3137:tid 3152] [client 158.158.52.11:18207] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tool.php"] [unique_id "acKubJdZesutm6dfYM9tNAAAAM0"]
[Tue Mar 24 23:31:57.429999 2026] [:error] [pid 38767:tid 38779] [client 158.158.52.11:15584] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tool.php"] [unique_id "acKubfwkUqN4GJAI5oV8_gAAAQk"]
[Tue Mar 24 23:31:58.662451 2026] [:error] [pid 48219:tid 48296] [client 158.158.52.11:23234] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/drhunthq.php"] [unique_id "acKubihf3b4R_lAIyv-mOQAAAg8"]
[Tue Mar 24 23:31:59.997065 2026] [:error] [pid 3137:tid 3152] [client 158.158.52.11:18192] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/drhunthq.php"] [unique_id "acKub5dZesutm6dfYM9tPQAAAM0"]
[Tue Mar 24 23:32:00.708583 2026] [:error] [pid 3137:tid 3143] [client 158.158.52.11:16010] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/drhunthq.php"] [unique_id "acKucJdZesutm6dfYM9tQQAAAMQ"]
[Tue Mar 24 23:32:01.878230 2026] [:error] [pid 3137:tid 3145] [client 158.158.52.11:21497] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/drhunthq.php"] [unique_id "acKucZdZesutm6dfYM9tRQAAAMY"]
[Tue Mar 24 23:32:03.586590 2026] [:error] [pid 3137:tid 3152] [client 158.158.52.11:18273] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acKuc5dZesutm6dfYM9tSwAAAM0"]
[Tue Mar 24 23:32:04.304841 2026] [:error] [pid 48214:tid 48276] [client 158.158.52.11:16038] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acKudLeshLWZ3uUDHKmJ0wAAAdg"]
[Tue Mar 24 23:32:05.359802 2026] [:error] [pid 3137:tid 3144] [client 158.158.52.11:2058] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acKudZdZesutm6dfYM9tVAAAAMU"]
[Tue Mar 24 23:32:06.347687 2026] [:error] [pid 3137:tid 3146] [client 158.158.52.11:22728] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acKudpdZesutm6dfYM9tWwAAAMc"]
[Tue Mar 24 23:32:08.748177 2026] [:error] [pid 48219:tid 48292] [client 158.158.52.11:23295] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a4.php"] [unique_id "acKueChf3b4R_lAIyv-mQwAAAgs"]
[Tue Mar 24 23:32:10.780444 2026] [:error] [pid 38767:tid 38771] [client 158.158.52.11:20248] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a4.php"] [unique_id "acKuevwkUqN4GJAI5oV9MAAAAQE"]
[Tue Mar 24 23:32:11.909163 2026] [:error] [pid 38767:tid 38790] [client 158.158.52.11:28470] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a4.php"] [unique_id "acKue_wkUqN4GJAI5oV9OQAAARQ"]
[Tue Mar 24 23:32:14.910959 2026] [:error] [pid 3137:tid 3144] [client 158.158.52.11:19793] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a4.php"] [unique_id "acKufpdZesutm6dfYM9tfgAAAMU"]
[Tue Mar 24 23:32:16.060703 2026] [:error] [pid 3137:tid 3151] [client 158.158.52.11:25625] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wen.php"] [unique_id "acKugJdZesutm6dfYM9tiQAAAMw"]
[Tue Mar 24 23:32:17.305655 2026] [:error] [pid 3032:tid 3104] [client 158.158.52.11:23259] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wen.php"] [unique_id "acKugSa_-JXXD03-JNxtdAAAAIE"]
[Tue Mar 24 23:32:18.118804 2026] [:error] [pid 48219:tid 48296] [client 158.158.52.11:18275] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wen.php"] [unique_id "acKugihf3b4R_lAIyv-mXgAAAg8"]
[Tue Mar 24 23:32:18.718724 2026] [:error] [pid 38767:tid 38778] [client 158.158.52.11:2097] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wen.php"] [unique_id "acKugvwkUqN4GJAI5oV9RAAAAQg"]
[Tue Mar 24 23:32:19.618710 2026] [:error] [pid 64198:tid 64216] [client 158.158.52.11:23261] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ms.php"] [unique_id "acKug3VzJqf6OS_oSZ3xFwAAAVA"]
[Tue Mar 24 23:32:20.452053 2026] [:error] [pid 64198:tid 64201] [client 158.158.52.11:23755] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ms.php"] [unique_id "acKuhHVzJqf6OS_oSZ3xGQAAAUE"]
[Tue Mar 24 23:32:21.342944 2026] [:error] [pid 48219:tid 48293] [client 158.158.52.11:23790] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ms.php"] [unique_id "acKuhShf3b4R_lAIyv-mZAAAAgw"]
[Tue Mar 24 23:32:24.053891 2026] [:error] [pid 48214:tid 48257] [client 158.158.52.11:19778] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ms.php"] [unique_id "acKuiLeshLWZ3uUDHKmJ2gAAAcU"]
[Tue Mar 24 23:32:25.232068 2026] [:error] [pid 3137:tid 3145] [client 158.158.52.11:16036] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acKuiZdZesutm6dfYM9trgAAAMY"]
[Tue Mar 24 23:32:25.972622 2026] [:error] [pid 3137:tid 3160] [client 158.158.52.11:22783] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acKuiZdZesutm6dfYM9ttAAAANU"]
[Tue Mar 24 23:32:28.705282 2026] [:error] [pid 3137:tid 3141] [client 158.158.52.11:23764] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acKujJdZesutm6dfYM9txQAAAMI"]
[Tue Mar 24 23:32:29.964690 2026] [:error] [pid 38767:tid 38791] [client 158.158.52.11:16013] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acKujfwkUqN4GJAI5oV9UAAAARU"]
[Tue Mar 24 23:32:30.920623 2026] [:error] [pid 64198:tid 64220] [client 158.158.52.11:25647] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acKujnVzJqf6OS_oSZ3xKQAAAVQ"]
[Tue Mar 24 23:32:33.567039 2026] [:error] [pid 48219:tid 48286] [client 158.158.52.11:15608] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acKukShf3b4R_lAIyv-mdgAAAgU"]
[Tue Mar 24 23:33:26.002371 2026] [:error] [pid 38767:tid 38782] [client 158.158.52.11:19802] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amax.php"] [unique_id "acKuxvwkUqN4GJAI5oV91gAAAQw"]
[Tue Mar 24 23:33:27.118993 2026] [:error] [pid 3137:tid 3159] [client 158.158.52.11:15562] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amax.php"] [unique_id "acKux5dZesutm6dfYM9uFAAAANQ"]
[Tue Mar 24 23:33:28.181889 2026] [:error] [pid 3137:tid 3143] [client 158.158.52.11:20258] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amax.php"] [unique_id "acKuyJdZesutm6dfYM9uGQAAAMQ"]
[Tue Mar 24 23:33:29.140566 2026] [:error] [pid 38767:tid 38778] [client 158.158.52.11:23290] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amax.php"] [unique_id "acKuyfwkUqN4GJAI5oV92QAAAQg"]
[Tue Mar 24 23:33:30.265797 2026] [:error] [pid 3137:tid 3158] [client 158.158.52.11:19815] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/66.php"] [unique_id "acKuypdZesutm6dfYM9uIAAAANM"]
[Tue Mar 24 23:33:31.130829 2026] [:error] [pid 3137:tid 3145] [client 158.158.52.11:19831] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/66.php"] [unique_id "acKuy5dZesutm6dfYM9uIwAAAMY"]
[Tue Mar 24 23:33:32.307044 2026] [:error] [pid 3137:tid 3152] [client 158.158.52.11:14817] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/66.php"] [unique_id "acKuzJdZesutm6dfYM9uKgAAAM0"]
[Tue Mar 24 23:33:33.403579 2026] [:error] [pid 3137:tid 3154] [client 158.158.52.11:23767] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/66.php"] [unique_id "acKuzZdZesutm6dfYM9uMAAAAM8"]
[Tue Mar 24 23:33:35.375628 2026] [:error] [pid 48214:tid 48261] [client 158.158.52.11:30358] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/file.php"] [unique_id "acKuz7eshLWZ3uUDHKmKAAAAAck"]
[Tue Mar 24 23:33:36.861071 2026] [:error] [pid 64198:tid 64209] [client 158.158.52.11:16029] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/file.php"] [unique_id "acKu0HVzJqf6OS_oSZ3xaQAAAUk"]
[Tue Mar 24 23:33:37.767588 2026] [:error] [pid 64198:tid 64215] [client 158.158.52.11:23803] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/file.php"] [unique_id "acKu0XVzJqf6OS_oSZ3xcQAAAU8"]
[Tue Mar 24 23:33:39.108488 2026] [:error] [pid 3032:tid 3119] [client 158.158.52.11:14720] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/file.php"] [unique_id "acKu0ya_-JXXD03-JNxthgAAAJA"]
[Tue Mar 24 23:33:40.132887 2026] [:error] [pid 3137:tid 3147] [client 158.158.52.11:14748] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/166.php"] [unique_id "acKu1JdZesutm6dfYM9uOwAAAMg"]
[Tue Mar 24 23:33:40.769723 2026] [:error] [pid 3137:tid 3163] [client 158.158.52.11:26620] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/166.php"] [unique_id "acKu1JdZesutm6dfYM9uPgAAANg"]
[Tue Mar 24 23:33:42.162104 2026] [:error] [pid 3137:tid 3150] [client 158.158.52.11:14816] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/166.php"] [unique_id "acKu1pdZesutm6dfYM9uRgAAAMs"]
[Tue Mar 24 23:33:43.776429 2026] [:error] [pid 3137:tid 3149] [client 158.158.52.11:14839] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/166.php"] [unique_id "acKu15dZesutm6dfYM9uUgAAAMo"]
[Tue Mar 24 23:33:44.588223 2026] [:error] [pid 3137:tid 3140] [client 158.158.52.11:23792] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acKu2JdZesutm6dfYM9uVgAAAME"]
[Tue Mar 24 23:33:46.058451 2026] [:error] [pid 3137:tid 3157] [client 158.158.52.11:29694] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acKu2pdZesutm6dfYM9uYgAAANI"]
[Tue Mar 24 23:33:47.073960 2026] [:error] [pid 3137:tid 3153] [client 158.158.52.11:27770] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acKu25dZesutm6dfYM9uagAAAM4"]
[Tue Mar 24 23:33:48.604715 2026] [:error] [pid 3031:tid 3099] [client 158.158.52.11:29661] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acKu3KJBKytnG47nuiZGXAAAAFc"]
[Tue Mar 24 23:33:49.628091 2026] [:error] [pid 38767:tid 38773] [client 158.158.52.11:18696] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/grsiuk.php"] [unique_id "acKu3fwkUqN4GJAI5oV98AAAAQM"]
[Tue Mar 24 23:33:50.615122 2026] [:error] [pid 3137:tid 3142] [client 158.158.52.11:16058] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/grsiuk.php"] [unique_id "acKu3pdZesutm6dfYM9udwAAAMM"]
[Tue Mar 24 23:33:51.547780 2026] [:error] [pid 3031:tid 3096] [client 158.158.52.11:27754] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/grsiuk.php"] [unique_id "acKu36JBKytnG47nuiZGXQAAAFQ"]
[Tue Mar 24 23:33:52.207622 2026] [:error] [pid 3032:tid 3128] [client 158.158.52.11:16107] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/grsiuk.php"] [unique_id "acKu4Ca_-JXXD03-JNxtiwAAAJg"]
[Tue Mar 24 23:33:52.986392 2026] [:error] [pid 48214:tid 48260] [client 158.158.52.11:26601] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acKu4LeshLWZ3uUDHKmKBgAAAcg"]
[Tue Mar 24 23:33:53.833144 2026] [:error] [pid 3032:tid 3123] [client 158.158.52.11:20300] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acKu4Sa_-JXXD03-JNxtkAAAAJQ"]
[Tue Mar 24 23:33:54.845936 2026] [:error] [pid 3137:tid 3142] [client 158.158.52.11:26600] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acKu4pdZesutm6dfYM9uggAAAMM"]
[Tue Mar 24 23:33:58.913126 2026] [:error] [pid 38767:tid 38778] [client 158.158.52.11:29662] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acKu5vwkUqN4GJAI5oV-AwAAAQg"]
[Tue Mar 24 23:34:00.580697 2026] [:error] [pid 48219:tid 48284] [client 158.158.52.11:18699] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/cu.php"] [unique_id "acKu6Chf3b4R_lAIyv-msQAAAgM"]
[Tue Mar 24 23:34:01.474745 2026] [:error] [pid 48214:tid 48260] [client 158.158.52.11:29147] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/cu.php"] [unique_id "acKu6beshLWZ3uUDHKmKKQAAAcg"]
[Tue Mar 24 23:34:02.229966 2026] [:error] [pid 64198:tid 64207] [client 158.158.52.11:17098] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/cu.php"] [unique_id "acKu6nVzJqf6OS_oSZ3xgAAAAUc"]
[Tue Mar 24 23:34:03.324422 2026] [:error] [pid 48214:tid 48267] [client 158.158.52.11:13823] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/cu.php"] [unique_id "acKu67eshLWZ3uUDHKmKKwAAAc8"]
[Tue Mar 24 23:34:04.327251 2026] [:error] [pid 48219:tid 48299] [client 158.158.52.11:29146] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/8.php"] [unique_id "acKu7Chf3b4R_lAIyv-muAAAAhI"]
[Tue Mar 24 23:34:05.407050 2026] [:error] [pid 48219:tid 48294] [client 158.158.52.11:13781] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/8.php"] [unique_id "acKu7Shf3b4R_lAIyv-muQAAAg0"]
[Tue Mar 24 23:34:07.420738 2026] [:error] [pid 3137:tid 3144] [client 158.158.52.11:17096] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/8.php"] [unique_id "acKu75dZesutm6dfYM9umwAAAMU"]
[Tue Mar 24 23:34:09.154904 2026] [:error] [pid 3137:tid 3150] [client 158.158.52.11:17128] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/8.php"] [unique_id "acKu8ZdZesutm6dfYM9unAAAAMs"]
[Tue Mar 24 23:34:10.603286 2026] [:error] [pid 64198:tid 64200] [client 158.158.52.11:20946] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws60.php"] [unique_id "acKu8nVzJqf6OS_oSZ3xjAAAAUA"]
[Tue Mar 24 23:34:12.080981 2026] [:error] [pid 48219:tid 48281] [client 158.158.52.11:30087] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws60.php"] [unique_id "acKu9Chf3b4R_lAIyv-mvgAAAgA"]
[Tue Mar 24 23:34:13.001193 2026] [:error] [pid 48219:tid 48295] [client 158.158.52.11:24262] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws60.php"] [unique_id "acKu9Shf3b4R_lAIyv-mvwAAAg4"]
[Tue Mar 24 23:34:14.786258 2026] [:error] [pid 3137:tid 3160] [client 158.158.52.11:2691] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ws60.php"] [unique_id "acKu9pdZesutm6dfYM9uqQAAANU"]
[Tue Mar 24 23:34:16.278012 2026] [:error] [pid 3137:tid 3139] [client 158.158.52.11:23494] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/vanda.php"] [unique_id "acKu-JdZesutm6dfYM9urgAAAMA"]
[Tue Mar 24 23:34:17.369473 2026] [:error] [pid 48214:tid 48261] [client 158.158.52.11:26338] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/vanda.php"] [unique_id "acKu-beshLWZ3uUDHKmKPQAAAck"]
[Tue Mar 24 23:34:19.283918 2026] [:error] [pid 48214:tid 48276] [client 158.158.52.11:11005] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/vanda.php"] [unique_id "acKu-7eshLWZ3uUDHKmKQAAAAdg"]
[Tue Mar 24 23:34:20.006559 2026] [:error] [pid 64198:tid 64212] [client 158.158.52.11:23543] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/vanda.php"] [unique_id "acKu_HVzJqf6OS_oSZ3xkgAAAUw"]
[Tue Mar 24 23:34:20.965752 2026] [:error] [pid 64198:tid 64204] [client 158.158.52.11:30106] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/domains.php"] [unique_id "acKu_HVzJqf6OS_oSZ3xkwAAAUQ"]
[Tue Mar 24 23:34:22.419624 2026] [:error] [pid 64198:tid 64223] [client 158.158.52.11:10945] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/domains.php"] [unique_id "acKu_nVzJqf6OS_oSZ3xlAAAAVc"]
[Tue Mar 24 23:34:23.715203 2026] [:error] [pid 3031:tid 3081] [client 158.158.52.11:24307] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/domains.php"] [unique_id "acKu_6JBKytnG47nuiZGZQAAAEU"]
[Tue Mar 24 23:34:43.840969 2026] [:error] [pid 3030:tid 3069] [client 158.158.52.11:18781] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acKvEwyOuILyynfcqflyvwAAABQ"]
[Tue Mar 24 23:34:47.129833 2026] [:error] [pid 48128:tid 48177] [client 158.158.52.11:25653] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acKvF8vR4LIMFLbM5VlJoAAAAZg"]
[Tue Mar 24 23:34:49.315148 2026] [:error] [pid 3137:tid 3141] [client 158.158.52.11:25641] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acKvGZdZesutm6dfYM9u7gAAAMI"]
[Tue Mar 24 23:34:50.488810 2026] [:error] [pid 38767:tid 38786] [client 158.158.52.11:16011] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acKvGvwkUqN4GJAI5oV-XgAAARA"]
[Tue Mar 24 23:34:51.601491 2026] [:error] [pid 3030:tid 3057] [client 158.158.52.11:23238] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acKvGwyOuILyynfcqflywwAAAAg"]
[Tue Mar 24 23:34:52.629271 2026] [:error] [pid 3137:tid 3143] [client 158.158.52.11:28462] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acKvHJdZesutm6dfYM9u8QAAAMQ"]
[Tue Mar 24 23:34:53.792185 2026] [:error] [pid 3030:tid 3067] [client 158.158.52.11:24461] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acKvHQyOuILyynfcqflyxgAAABI"]
[Tue Mar 24 23:34:55.138860 2026] [:error] [pid 3031:tid 3076] [client 158.158.52.11:16305] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acKvH6JBKytnG47nuiZGbwAAAEA"]
[Tue Mar 24 23:34:57.372875 2026] [:error] [pid 3137:tid 3158] [client 158.158.52.11:2065] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acKvIZdZesutm6dfYM9u-QAAANM"]
[Tue Mar 24 23:34:58.784914 2026] [:error] [pid 3137:tid 3140] [client 158.158.52.11:24565] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acKvIpdZesutm6dfYM9vAgAAAME"]
[Tue Mar 24 23:35:03.457874 2026] [:error] [pid 3137:tid 3154] [client 158.158.52.11:24537] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acKvJ5dZesutm6dfYM9vEgAAAM8"]
[Tue Mar 24 23:35:04.449395 2026] [:error] [pid 48219:tid 48296] [client 158.158.52.11:29010] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acKvKChf3b4R_lAIyv-m2QAAAg8"]
[Tue Mar 24 23:35:06.917723 2026] [:error] [pid 48219:tid 48301] [client 158.158.52.11:11502] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/varb.php"] [unique_id "acKvKihf3b4R_lAIyv-m2gAAAhQ"]
[Tue Mar 24 23:35:11.666056 2026] [:error] [pid 3137:tid 3144] [client 158.158.52.11:20033] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/varb.php"] [unique_id "acKvL5dZesutm6dfYM9vMAAAAMU"]
[Tue Mar 24 23:35:15.344339 2026] [:error] [pid 48214:tid 48270] [client 158.158.52.11:24920] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/varb.php"] [unique_id "acKvM7eshLWZ3uUDHKmKYAAAAdI"]
[Tue Mar 24 23:35:17.735865 2026] [:error] [pid 38767:tid 38778] [client 158.158.52.11:26384] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/varb.php"] [unique_id "acKvNfwkUqN4GJAI5oV-hwAAAQg"]
[Tue Mar 24 23:35:18.955660 2026] [:error] [pid 48214:tid 48269] [client 158.158.52.11:29922] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lm15.php"] [unique_id "acKvNreshLWZ3uUDHKmKZwAAAdE"]
[Tue Mar 24 23:35:20.315935 2026] [:error] [pid 64198:tid 64210] [client 158.158.52.11:31117] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lm15.php"] [unique_id "acKvOHVzJqf6OS_oSZ3xwgAAAUo"]
[Tue Mar 24 23:35:21.755459 2026] [:error] [pid 3137:tid 3158] [client 158.158.52.11:15517] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lm15.php"] [unique_id "acKvOZdZesutm6dfYM9vRgAAANM"]
[Tue Mar 24 23:35:22.707672 2026] [:error] [pid 3137:tid 3163] [client 158.158.52.11:29920] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lm15.php"] [unique_id "acKvOpdZesutm6dfYM9vTAAAANg"]
[Tue Mar 24 23:35:23.602561 2026] [:error] [pid 48214:tid 48271] [client 158.158.52.11:11996] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/clss.php"] [unique_id "acKvO7eshLWZ3uUDHKmKbgAAAdM"]
[Tue Mar 24 23:35:25.166124 2026] [:error] [pid 48214:tid 48267] [client 158.158.52.11:12427] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/clss.php"] [unique_id "acKvPbeshLWZ3uUDHKmKcwAAAc8"]
[Tue Mar 24 23:35:26.080603 2026] [:error] [pid 38767:tid 38771] [client 158.158.52.11:11240] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/clss.php"] [unique_id "acKvPvwkUqN4GJAI5oV-kAAAAQE"]
[Tue Mar 24 23:35:26.992603 2026] [:error] [pid 48219:tid 48288] [client 158.158.52.11:11656] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/clss.php"] [unique_id "acKvPihf3b4R_lAIyv-m7gAAAgc"]
[Tue Mar 24 23:35:28.221772 2026] [:error] [pid 3137:tid 3140] [client 158.158.52.11:26237] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/44.php"] [unique_id "acKvQJdZesutm6dfYM9vUAAAAME"]
[Tue Mar 24 23:35:28.853854 2026] [:error] [pid 3137:tid 3152] [client 158.158.52.11:11243] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/44.php"] [unique_id "acKvQJdZesutm6dfYM9vUwAAAM0"]
[Tue Mar 24 23:35:30.648458 2026] [:error] [pid 3137:tid 3152] [client 158.158.52.11:30973] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/44.php"] [unique_id "acKvQpdZesutm6dfYM9vWgAAAM0"]
[Tue Mar 24 23:35:31.755818 2026] [:error] [pid 38767:tid 38789] [client 158.158.52.11:30893] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/44.php"] [unique_id "acKvQ_wkUqN4GJAI5oV-kwAAARM"]
[Tue Mar 24 23:35:32.389227 2026] [:error] [pid 48214:tid 48253] [client 158.158.52.11:19461] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a5e0a.php"] [unique_id "acKvRLeshLWZ3uUDHKmKewAAAcE"]
[Tue Mar 24 23:35:33.604486 2026] [:error] [pid 38767:tid 38783] [client 158.158.52.11:21996] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a5e0a.php"] [unique_id "acKvRfwkUqN4GJAI5oV-mAAAAQ0"]
[Tue Mar 24 23:35:34.655024 2026] [:error] [pid 64198:tid 64217] [client 158.158.52.11:12945] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a5e0a.php"] [unique_id "acKvRnVzJqf6OS_oSZ3x3AAAAVE"]
[Tue Mar 24 23:35:35.831905 2026] [:error] [pid 48214:tid 48273] [client 158.158.52.11:11693] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a5e0a.php"] [unique_id "acKvR7eshLWZ3uUDHKmKfAAAAdU"]
[Tue Mar 24 23:35:36.580741 2026] [:error] [pid 3032:tid 3110] [client 158.158.52.11:30535] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bo.php"] [unique_id "acKvSCa_-JXXD03-JNxtqwAAAIc"]
[Tue Mar 24 23:35:37.455982 2026] [:error] [pid 3032:tid 3107] [client 158.158.52.11:29111] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bo.php"] [unique_id "acKvSSa_-JXXD03-JNxtrgAAAIQ"]
[Tue Mar 24 23:35:39.329664 2026] [:error] [pid 38767:tid 38792] [client 158.158.52.11:29941] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bo.php"] [unique_id "acKvS_wkUqN4GJAI5oV-owAAARY"]
[Tue Mar 24 23:35:40.442770 2026] [:error] [pid 3137:tid 3145] [client 158.158.52.11:12441] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bo.php"] [unique_id "acKvTJdZesutm6dfYM9vZAAAAMY"]
[Tue Mar 24 23:35:41.474062 2026] [:error] [pid 48214:tid 48269] [client 158.158.52.11:28058] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/56c53.php"] [unique_id "acKvTbeshLWZ3uUDHKmKfwAAAdE"]
[Tue Mar 24 23:36:00.804301 2026] [:error] [pid 3030:tid 3069] [client 158.158.52.11:21992] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/callback.php"] [unique_id "acKvYAyOuILyynfcqfly6gAAABQ"]
[Tue Mar 24 23:36:01.728455 2026] [:error] [pid 3137:tid 3142] [client 158.158.52.11:12461] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/callback.php"] [unique_id "acKvYZdZesutm6dfYM9vqAAAAMM"]
[Tue Mar 24 23:36:03.990679 2026] [:error] [pid 48214:tid 48252] [client 158.158.52.11:11664] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/callback.php"] [unique_id "acKvY7eshLWZ3uUDHKmKhwAAAcA"]
[Tue Mar 24 23:36:05.264311 2026] [:error] [pid 48219:tid 48295] [client 158.158.52.11:12676] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/callback.php"] [unique_id "acKvZShf3b4R_lAIyv-nDAAAAg4"]
[Tue Mar 24 23:36:06.273486 2026] [:error] [pid 3030:tid 3058] [client 158.158.52.11:14038] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file.php"] [unique_id "acKvZgyOuILyynfcqfly7gAAAAk"]
[Tue Mar 24 23:36:07.138850 2026] [:error] [pid 64198:tid 64216] [client 158.158.52.11:26226] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file.php"] [unique_id "acKvZ3VzJqf6OS_oSZ3yAwAAAVA"]
[Tue Mar 24 23:36:08.005145 2026] [:error] [pid 64198:tid 64209] [client 158.158.52.11:13020] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file.php"] [unique_id "acKvaHVzJqf6OS_oSZ3yBgAAAUk"]
[Tue Mar 24 23:36:08.970801 2026] [:error] [pid 3030:tid 3062] [client 158.158.52.11:21194] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file.php"] [unique_id "acKvaAyOuILyynfcqfly8wAAAA0"]
[Tue Mar 24 23:36:09.972589 2026] [:error] [pid 48214:tid 48252] [client 158.158.52.11:24737] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acKvabeshLWZ3uUDHKmKkQAAAcA"]
[Tue Mar 24 23:36:10.763466 2026] [:error] [pid 3137:tid 3160] [client 158.158.52.11:3009] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acKvapdZesutm6dfYM9vtAAAANU"]
[Tue Mar 24 23:36:12.004818 2026] [:error] [pid 38767:tid 38779] [client 158.158.52.11:24856] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acKvbPwkUqN4GJAI5oV-6wAAAQk"]
[Tue Mar 24 23:36:13.741444 2026] [:error] [pid 48128:tid 48149] [client 158.158.52.11:2777] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acKvbcvR4LIMFLbM5VlJswAAAYA"]
[Tue Mar 24 23:36:14.702103 2026] [:error] [pid 48219:tid 48285] [client 158.158.52.11:21185] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acKvbihf3b4R_lAIyv-nGgAAAgQ"]
[Tue Mar 24 23:36:15.526768 2026] [:error] [pid 48219:tid 48291] [client 158.158.52.11:31017] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acKvbyhf3b4R_lAIyv-nIAAAAgo"]
[Tue Mar 24 23:36:16.487212 2026] [:error] [pid 3031:tid 3092] [client 158.158.52.11:3040] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acKvcKJBKytnG47nuiZGhQAAAFA"]
[Tue Mar 24 23:36:17.223384 2026] [:error] [pid 64198:tid 64202] [client 158.158.52.11:12728] [client 158.158.52.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acKvcXVzJqf6OS_oSZ3yFgAAAUI"]
[Wed Mar 25 00:31:09.150431 2026] [:error] [pid 57702:tid 57903] [client 223.178.84.115:10384] [client 223.178.84.115] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.178.84.115, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acK8TaS8TU_xcQFvlnbxFgAAAAA"]
[Wed Mar 25 00:35:51.771198 2026] [:error] [pid 57702:tid 57907] [client 20.151.251.35:30302] [client 20.151.251.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.151.251.35, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acK9Z6S8TU_xcQFvlnb0GgAAAAQ"]
[Wed Mar 25 00:35:55.424574 2026] [:error] [pid 57702:tid 57911] [client 20.151.251.35:30302] [client 20.151.251.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acK9a6S8TU_xcQFvlnb0UwAAAAg"]
[Wed Mar 25 00:35:58.145095 2026] [:error] [pid 57703:tid 58043] [client 20.151.251.35:30328] [client 20.151.251.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "acK9bvIVQxDtjkklWGZNrwAAAFg"]
[Wed Mar 25 00:35:59.811083 2026] [:error] [pid 57703:tid 58022] [client 20.151.251.35:29969] [client 20.151.251.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "acK9b_IVQxDtjkklWGZNugAAAEM"]
[Wed Mar 25 00:36:02.315848 2026] [:error] [pid 58154:tid 58178] [client 20.151.251.35:29972] [client 20.151.251.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "acK9cg0pGUh6bwD3ouJ6-QAAANU"]
[Wed Mar 25 01:46:25.667189 2026] [:error] [pid 57703:tid 58022] [client 4.223.157.92:10984] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/buc.php"] [unique_id "acLN8fIVQxDtjkklWGZgrAAAAEM"]
[Wed Mar 25 01:46:26.195508 2026] [:error] [pid 20371:tid 20395] [client 4.223.157.92:10893] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/buc.php"] [unique_id "acLN8ub25OL4yTv2fF-U8wAAARY"]
[Wed Mar 25 01:46:26.782762 2026] [:error] [pid 57711:tid 58060] [client 4.223.157.92:10965] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/buc.php"] [unique_id "acLN8qLdPFdeRRktTdNigAAAAIg"]
[Wed Mar 25 01:46:27.308822 2026] [:error] [pid 20371:tid 20386] [client 4.223.157.92:10945] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/buc.php"] [unique_id "acLN8-b25OL4yTv2fF-U-AAAAQ0"]
[Wed Mar 25 01:46:27.847723 2026] [:error] [pid 20371:tid 20383] [client 4.223.157.92:11001] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ww.php"] [unique_id "acLN8-b25OL4yTv2fF-U_AAAAQo"]
[Wed Mar 25 01:46:28.374577 2026] [:error] [pid 57702:tid 57904] [client 4.223.157.92:10897] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ww.php"] [unique_id "acLN9KS8TU_xcQFvlnYPXAAAAAE"]
[Wed Mar 25 01:46:28.926087 2026] [:error] [pid 57703:tid 58028] [client 4.223.157.92:10910] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ww.php"] [unique_id "acLN9PIVQxDtjkklWGZgrwAAAEk"]
[Wed Mar 25 01:46:29.451589 2026] [:error] [pid 20371:tid 20388] [client 4.223.157.92:10974] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ww.php"] [unique_id "acLN9eb25OL4yTv2fF-VBAAAAQ8"]
[Wed Mar 25 01:46:29.988118 2026] [:error] [pid 20371:tid 20390] [client 4.223.157.92:10961] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rithin.php"] [unique_id "acLN9eb25OL4yTv2fF-VCAAAARE"]
[Wed Mar 25 01:46:30.523833 2026] [:error] [pid 57703:tid 58035] [client 4.223.157.92:10892] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rithin.php"] [unique_id "acLN9vIVQxDtjkklWGZgsgAAAFA"]
[Wed Mar 25 01:46:31.061403 2026] [:error] [pid 57702:tid 57909] [client 4.223.157.92:10899] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rithin.php"] [unique_id "acLN96S8TU_xcQFvlnYPXQAAAAY"]
[Wed Mar 25 01:46:31.590554 2026] [:error] [pid 57711:tid 58080] [client 4.223.157.92:10908] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rithin.php"] [unique_id "acLN96LdPFdeRRktTdNigQAAAJg"]
[Wed Mar 25 01:46:32.147181 2026] [:error] [pid 57702:tid 57906] [client 4.223.157.92:10992] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acLN-KS8TU_xcQFvlnYPXgAAAAM"]
[Wed Mar 25 01:46:32.675308 2026] [:error] [pid 20371:tid 20390] [client 4.223.157.92:10954] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acLN-Ob25OL4yTv2fF-VEwAAARE"]
[Wed Mar 25 01:46:33.231504 2026] [:error] [pid 57703:tid 58020] [client 4.223.157.92:10960] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acLN-fIVQxDtjkklWGZguAAAAEE"]
[Wed Mar 25 01:46:33.762498 2026] [:error] [pid 57702:tid 57911] [client 4.223.157.92:10981] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acLN-aS8TU_xcQFvlnYPXwAAAAg"]
[Wed Mar 25 01:46:34.302310 2026] [:error] [pid 57703:tid 58042] [client 4.223.157.92:3043] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acLN-vIVQxDtjkklWGZguQAAAFc"]
[Wed Mar 25 01:46:34.830243 2026] [:error] [pid 20371:tid 20391] [client 4.223.157.92:10972] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acLN-ub25OL4yTv2fF-VGwAAARI"]
[Wed Mar 25 01:46:35.391815 2026] [:error] [pid 58154:tid 58168] [client 4.223.157.92:10900] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acLN-w0pGUh6bwD3ouKgrgAAAMs"]
[Wed Mar 25 01:46:35.918721 2026] [:error] [pid 58154:tid 58165] [client 4.223.157.92:10994] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acLN-w0pGUh6bwD3ouKgsAAAAMg"]
[Wed Mar 25 01:46:36.457748 2026] [:error] [pid 57702:tid 57913] [client 4.223.157.92:10891] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acLN_KS8TU_xcQFvlnYPYwAAAAo"]
[Wed Mar 25 01:46:36.985519 2026] [:error] [pid 57702:tid 57919] [client 4.223.157.92:10997] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acLN_KS8TU_xcQFvlnYPZAAAABA"]
[Wed Mar 25 01:46:37.548074 2026] [:error] [pid 57711:tid 58051] [client 4.223.157.92:10935] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acLN_aLdPFdeRRktTdNihQAAAIE"]
[Wed Mar 25 01:46:38.077871 2026] [:error] [pid 57702:tid 57907] [client 4.223.157.92:10987] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acLN_qS8TU_xcQFvlnYPZwAAAAQ"]
[Wed Mar 25 01:46:38.630564 2026] [:error] [pid 57711:tid 58071] [client 4.223.157.92:10966] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acLN_qLdPFdeRRktTdNiiAAAAJE"]
[Wed Mar 25 01:46:39.158514 2026] [:error] [pid 57702:tid 57921] [client 4.223.157.92:10946] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acLN_6S8TU_xcQFvlnYPaQAAABI"]
[Wed Mar 25 01:46:39.698583 2026] [:error] [pid 20371:tid 20394] [client 4.223.157.92:10990] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acLN_-b25OL4yTv2fF-VJgAAARU"]
[Wed Mar 25 01:46:40.226138 2026] [:error] [pid 20371:tid 20387] [client 4.223.157.92:10944] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acLOAOb25OL4yTv2fF-VKQAAAQ4"]
[Wed Mar 25 01:46:40.774807 2026] [:error] [pid 57711:tid 58050] [client 4.223.157.92:10896] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acLOAKLdPFdeRRktTdNiiQAAAIA"]
[Wed Mar 25 01:46:41.303482 2026] [:error] [pid 20371:tid 20395] [client 4.223.157.92:10921] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acLOAeb25OL4yTv2fF-VLgAAARY"]
[Wed Mar 25 01:46:41.866476 2026] [:error] [pid 20371:tid 20383] [client 4.223.157.92:10882] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acLOAeb25OL4yTv2fF-VMAAAAQo"]
[Wed Mar 25 01:46:42.392814 2026] [:error] [pid 57711:tid 58056] [client 4.223.157.92:10950] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acLOAqLdPFdeRRktTdNiiwAAAIU"]
[Wed Mar 25 01:46:42.931909 2026] [:error] [pid 20371:tid 20385] [client 4.223.157.92:10894] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acLOAub25OL4yTv2fF-VOAAAAQw"]
[Wed Mar 25 01:46:43.463311 2026] [:error] [pid 57702:tid 57917] [client 4.223.157.92:10903] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acLOA6S8TU_xcQFvlnYPagAAAA4"]
[Wed Mar 25 01:46:44.034048 2026] [:error] [pid 57702:tid 57912] [client 4.223.157.92:10941] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acLOBKS8TU_xcQFvlnYPawAAAAk"]
[Wed Mar 25 01:46:44.564738 2026] [:error] [pid 57702:tid 57916] [client 4.223.157.92:3028] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acLOBKS8TU_xcQFvlnYPbQAAAA0"]
[Wed Mar 25 01:46:45.123981 2026] [:error] [pid 20371:tid 20374] [client 4.223.157.92:10883] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h2.php"] [unique_id "acLOBeb25OL4yTv2fF-VPAAAAQE"]
[Wed Mar 25 01:46:45.659661 2026] [:error] [pid 58154:tid 58157] [client 4.223.157.92:10977] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h2.php"] [unique_id "acLOBQ0pGUh6bwD3ouKgsQAAAMA"]
[Wed Mar 25 01:46:46.192917 2026] [:error] [pid 20371:tid 20387] [client 4.223.157.92:10887] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h2.php"] [unique_id "acLOBub25OL4yTv2fF-VPgAAAQ4"]
[Wed Mar 25 01:46:46.721603 2026] [:error] [pid 57711:tid 58076] [client 4.223.157.92:3020] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h2.php"] [unique_id "acLOBqLdPFdeRRktTdNijwAAAJY"]
[Wed Mar 25 01:46:47.261540 2026] [:error] [pid 20371:tid 20377] [client 4.223.157.92:10998] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dass.php"] [unique_id "acLOB-b25OL4yTv2fF-VQgAAAQQ"]
[Wed Mar 25 01:46:47.791041 2026] [:error] [pid 57711:tid 58051] [client 4.223.157.92:10881] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dass.php"] [unique_id "acLOB6LdPFdeRRktTdNikwAAAIE"]
[Wed Mar 25 01:46:48.319834 2026] [:error] [pid 57703:tid 58034] [client 4.223.157.92:10980] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dass.php"] [unique_id "acLOCPIVQxDtjkklWGZgwgAAAE8"]
[Wed Mar 25 01:46:48.847425 2026] [:error] [pid 58154:tid 58181] [client 4.223.157.92:10953] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dass.php"] [unique_id "acLOCA0pGUh6bwD3ouKgsgAAANg"]
[Wed Mar 25 01:46:49.384889 2026] [:error] [pid 58154:tid 58164] [client 4.223.157.92:10928] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/s.php"] [unique_id "acLOCQ0pGUh6bwD3ouKgswAAAMc"]
[Wed Mar 25 01:46:49.914573 2026] [:error] [pid 20371:tid 20393] [client 4.223.157.92:10969] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/s.php"] [unique_id "acLOCeb25OL4yTv2fF-VRQAAARQ"]
[Wed Mar 25 01:46:50.458524 2026] [:error] [pid 58154:tid 58175] [client 4.223.157.92:10988] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/s.php"] [unique_id "acLOCg0pGUh6bwD3ouKgtwAAANI"]
[Wed Mar 25 01:46:50.986491 2026] [:error] [pid 57711:tid 58058] [client 4.223.157.92:10991] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/s.php"] [unique_id "acLOCqLdPFdeRRktTdNimQAAAIY"]
[Wed Mar 25 01:46:51.546192 2026] [:error] [pid 20371:tid 20379] [client 4.223.157.92:10956] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kj.php"] [unique_id "acLOC-b25OL4yTv2fF-VSwAAAQY"]
[Wed Mar 25 01:46:52.072087 2026] [:error] [pid 58154:tid 58161] [client 4.223.157.92:10971] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kj.php"] [unique_id "acLODA0pGUh6bwD3ouKguAAAAMQ"]
[Wed Mar 25 01:46:52.609456 2026] [:error] [pid 20371:tid 20393] [client 4.223.157.92:3017] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kj.php"] [unique_id "acLODOb25OL4yTv2fF-VUAAAARQ"]
[Wed Mar 25 01:46:53.137133 2026] [:error] [pid 20371:tid 20384] [client 4.223.157.92:10895] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kj.php"] [unique_id "acLODeb25OL4yTv2fF-VUQAAAQs"]
[Wed Mar 25 01:46:54.668994 2026] [:error] [pid 20371:tid 20391] [client 4.223.157.92:3053] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws83.php"] [unique_id "acLODub25OL4yTv2fF-VVwAAARI"]
[Wed Mar 25 01:46:55.195427 2026] [:error] [pid 20371:tid 20381] [client 4.223.157.92:11002] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws83.php"] [unique_id "acLOD-b25OL4yTv2fF-VWgAAAQg"]
[Wed Mar 25 01:46:55.727007 2026] [:error] [pid 58154:tid 58165] [client 4.223.157.92:10952] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws83.php"] [unique_id "acLODw0pGUh6bwD3ouKgvQAAAMg"]
[Wed Mar 25 01:46:56.263117 2026] [:error] [pid 20371:tid 20388] [client 4.223.157.92:3033] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws83.php"] [unique_id "acLOEOb25OL4yTv2fF-VXAAAAQ8"]
[Wed Mar 25 01:46:56.790201 2026] [:error] [pid 20371:tid 20395] [client 4.223.157.92:11005] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws75.php"] [unique_id "acLOEOb25OL4yTv2fF-VYAAAARY"]
[Wed Mar 25 01:46:57.315565 2026] [:error] [pid 20371:tid 20394] [client 4.223.157.92:10931] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws75.php"] [unique_id "acLOEeb25OL4yTv2fF-VYgAAARU"]
[Wed Mar 25 01:46:57.867652 2026] [:error] [pid 58154:tid 58181] [client 4.223.157.92:10916] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws75.php"] [unique_id "acLOEQ0pGUh6bwD3ouKgwAAAANg"]
[Wed Mar 25 01:46:58.416638 2026] [:error] [pid 20371:tid 20385] [client 4.223.157.92:11006] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws75.php"] [unique_id "acLOEub25OL4yTv2fF-VaAAAAQw"]
[Wed Mar 25 01:46:58.960063 2026] [:error] [pid 57702:tid 57914] [client 4.223.157.92:10959] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acLOEqS8TU_xcQFvlnYPcQAAAAs"]
[Wed Mar 25 01:46:59.533944 2026] [:error] [pid 57703:tid 58026] [client 4.223.157.92:10924] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acLOE_IVQxDtjkklWGZgxgAAAEc"]
[Wed Mar 25 01:47:00.060671 2026] [:error] [pid 57711:tid 58063] [client 4.223.157.92:10920] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acLOFKLdPFdeRRktTdNinAAAAIo"]
[Wed Mar 25 01:47:00.617475 2026] [:error] [pid 57703:tid 58043] [client 4.223.157.92:11004] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acLOFPIVQxDtjkklWGZgyAAAAFg"]
[Wed Mar 25 01:47:01.157402 2026] [:error] [pid 58154:tid 58157] [client 4.223.157.92:10888] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abc.php"] [unique_id "acLOFQ0pGUh6bwD3ouKgygAAAMA"]
[Wed Mar 25 01:47:01.688052 2026] [:error] [pid 58154:tid 58160] [client 4.223.157.92:10934] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abc.php"] [unique_id "acLOFQ0pGUh6bwD3ouKgzAAAAMM"]
[Wed Mar 25 01:47:02.218228 2026] [:error] [pid 20371:tid 20379] [client 4.223.157.92:10995] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abc.php"] [unique_id "acLOFub25OL4yTv2fF-VbQAAAQY"]
[Wed Mar 25 01:47:02.750335 2026] [:error] [pid 58154:tid 58179] [client 4.223.157.92:10906] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abc.php"] [unique_id "acLOFg0pGUh6bwD3ouKg0QAAANY"]
[Wed Mar 25 01:47:03.278869 2026] [:error] [pid 20371:tid 20377] [client 4.223.157.92:10919] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "acLOF-b25OL4yTv2fF-VbwAAAQQ"]
[Wed Mar 25 01:47:03.809126 2026] [:error] [pid 20371:tid 20385] [client 4.223.157.92:10930] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "acLOF-b25OL4yTv2fF-VcAAAAQw"]
[Wed Mar 25 01:47:04.335016 2026] [:error] [pid 58154:tid 58167] [client 4.223.157.92:3039] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "acLOGA0pGUh6bwD3ouKg1wAAAMo"]
[Wed Mar 25 01:47:04.862815 2026] [:error] [pid 57702:tid 57906] [client 4.223.157.92:10925] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "acLOGKS8TU_xcQFvlnYPegAAAAM"]
[Wed Mar 25 01:47:05.407732 2026] [:error] [pid 20371:tid 20391] [client 4.223.157.92:10901] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "acLOGeb25OL4yTv2fF-VcQAAARI"]
[Wed Mar 25 01:47:05.933093 2026] [:error] [pid 20371:tid 20374] [client 4.223.157.92:3030] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "acLOGeb25OL4yTv2fF-VdQAAAQE"]
[Wed Mar 25 01:47:06.491774 2026] [:error] [pid 57702:tid 57914] [client 4.223.157.92:10927] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "acLOGqS8TU_xcQFvlnYPfQAAAAs"]
[Wed Mar 25 01:47:07.031581 2026] [:error] [pid 57703:tid 58027] [client 4.223.157.92:3027] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "acLOG_IVQxDtjkklWGZgzAAAAEg"]
[Wed Mar 25 01:47:07.576978 2026] [:error] [pid 20371:tid 20394] [client 4.223.157.92:10979] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acLOG-b25OL4yTv2fF-VeAAAARU"]
[Wed Mar 25 01:47:08.105729 2026] [:error] [pid 57702:tid 57924] [client 4.223.157.92:10940] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acLOHKS8TU_xcQFvlnYPfwAAABU"]
[Wed Mar 25 01:47:08.643353 2026] [:error] [pid 58154:tid 58164] [client 4.223.157.92:10904] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acLOHA0pGUh6bwD3ouKg4AAAAMc"]
[Wed Mar 25 01:47:09.173564 2026] [:error] [pid 20371:tid 20377] [client 4.223.157.92:10962] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acLOHeb25OL4yTv2fF-VfAAAAQQ"]
[Wed Mar 25 01:47:09.720791 2026] [:error] [pid 57711:tid 58071] [client 4.223.157.92:10985] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/vx.php"] [unique_id "acLOHaLdPFdeRRktTdNioQAAAJE"]
[Wed Mar 25 01:47:10.249464 2026] [:error] [pid 20371:tid 20393] [client 4.223.157.92:10964] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/vx.php"] [unique_id "acLOHub25OL4yTv2fF-VhQAAARQ"]
[Wed Mar 25 01:47:10.793180 2026] [:error] [pid 58154:tid 58179] [client 4.223.157.92:10890] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/vx.php"] [unique_id "acLOHg0pGUh6bwD3ouKg5QAAANY"]
[Wed Mar 25 01:47:11.318503 2026] [:error] [pid 57702:tid 57920] [client 4.223.157.92:10907] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/vx.php"] [unique_id "acLOH6S8TU_xcQFvlnYPgQAAABE"]
[Wed Mar 25 01:47:11.883794 2026] [:error] [pid 58154:tid 58174] [client 4.223.157.92:3009] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acLOHw0pGUh6bwD3ouKg6AAAANE"]
[Wed Mar 25 01:47:12.420034 2026] [:error] [pid 20371:tid 20387] [client 4.223.157.92:10918] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acLOIOb25OL4yTv2fF-VhgAAAQ4"]
[Wed Mar 25 01:47:12.952594 2026] [:error] [pid 57703:tid 58030] [client 4.223.157.92:2980] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acLOIPIVQxDtjkklWGZg0QAAAEs"]
[Wed Mar 25 01:47:13.487338 2026] [:error] [pid 57702:tid 57922] [client 4.223.157.92:10909] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acLOIaS8TU_xcQFvlnYPgwAAABM"]
[Wed Mar 25 01:47:14.024068 2026] [:error] [pid 58154:tid 58175] [client 4.223.157.92:10911] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acLOIg0pGUh6bwD3ouKg7AAAANI"]
[Wed Mar 25 01:47:14.562369 2026] [:error] [pid 58154:tid 58178] [client 4.223.157.92:3011] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acLOIg0pGUh6bwD3ouKg7QAAANU"]
[Wed Mar 25 01:47:15.096868 2026] [:error] [pid 57703:tid 58032] [client 4.223.157.92:10989] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acLOI_IVQxDtjkklWGZg0gAAAE0"]
[Wed Mar 25 01:47:15.633397 2026] [:error] [pid 57703:tid 58041] [client 4.223.157.92:10912] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acLOI_IVQxDtjkklWGZg1AAAAFY"]
[Wed Mar 25 01:47:16.173621 2026] [:error] [pid 57703:tid 58035] [client 4.223.157.92:10923] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "acLOJPIVQxDtjkklWGZg1gAAAFA"]
[Wed Mar 25 01:47:16.701929 2026] [:error] [pid 58154:tid 58158] [client 4.223.157.92:10948] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "acLOJA0pGUh6bwD3ouKg8QAAAME"]
[Wed Mar 25 01:47:17.238284 2026] [:error] [pid 20371:tid 20392] [client 4.223.157.92:10970] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "acLOJeb25OL4yTv2fF-VkgAAARM"]
[Wed Mar 25 01:47:17.777110 2026] [:error] [pid 58154:tid 58177] [client 4.223.157.92:10936] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "acLOJQ0pGUh6bwD3ouKg8wAAANQ"]
[Wed Mar 25 01:47:18.310899 2026] [:error] [pid 57703:tid 58043] [client 4.223.157.92:3021] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acLOJvIVQxDtjkklWGZg2AAAAFg"]
[Wed Mar 25 01:47:18.846415 2026] [:error] [pid 57703:tid 58037] [client 4.223.157.92:10937] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acLOJvIVQxDtjkklWGZg2gAAAFI"]
[Wed Mar 25 01:47:19.383954 2026] [:error] [pid 58154:tid 58160] [client 4.223.157.92:10943] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acLOJw0pGUh6bwD3ouKg9gAAAMM"]
[Wed Mar 25 01:47:19.918566 2026] [:error] [pid 20371:tid 20392] [client 4.223.157.92:2953] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acLOJ-b25OL4yTv2fF-VngAAARM"]
[Wed Mar 25 01:47:20.455878 2026] [:error] [pid 20371:tid 20383] [client 4.223.157.92:3010] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/ws49.php"] [unique_id "acLOKOb25OL4yTv2fF-VoAAAAQo"]
[Wed Mar 25 01:47:20.984016 2026] [:error] [pid 58154:tid 58181] [client 4.223.157.92:3056] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/ws49.php"] [unique_id "acLOKA0pGUh6bwD3ouKg-QAAANg"]
[Wed Mar 25 01:47:21.532511 2026] [:error] [pid 57703:tid 58038] [client 4.223.157.92:10884] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/ws49.php"] [unique_id "acLOKfIVQxDtjkklWGZg3AAAAFM"]
[Wed Mar 25 01:47:22.076415 2026] [:error] [pid 57703:tid 58034] [client 4.223.157.92:10968] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/ws49.php"] [unique_id "acLOKvIVQxDtjkklWGZg3gAAAE8"]
[Wed Mar 25 01:47:22.620784 2026] [:error] [pid 20371:tid 20389] [client 4.223.157.92:2986] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acLOKub25OL4yTv2fF-VqAAAARA"]
[Wed Mar 25 01:47:23.151195 2026] [:error] [pid 20371:tid 20377] [client 4.223.157.92:2982] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acLOK-b25OL4yTv2fF-VrQAAAQQ"]
[Wed Mar 25 01:47:23.681804 2026] [:error] [pid 20371:tid 20392] [client 4.223.157.92:10957] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acLOK-b25OL4yTv2fF-VsAAAARM"]
[Wed Mar 25 01:47:40.830749 2026] [:error] [pid 20371:tid 20376] [client 4.223.157.92:10973] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xxw.php"] [unique_id "acLOPOb25OL4yTv2fF-V2wAAAQM"]
[Wed Mar 25 01:47:41.360737 2026] [:error] [pid 57711:tid 58050] [client 4.223.157.92:3024] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xxw.php"] [unique_id "acLOPaLdPFdeRRktTdNivQAAAIA"]
[Wed Mar 25 01:47:41.892538 2026] [:error] [pid 20371:tid 20397] [client 4.223.157.92:3044] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xxw.php"] [unique_id "acLOPeb25OL4yTv2fF-V3QAAARg"]
[Wed Mar 25 01:47:42.421169 2026] [:error] [pid 20371:tid 20378] [client 4.223.157.92:2944] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xxw.php"] [unique_id "acLOPub25OL4yTv2fF-V3wAAAQU"]
[Wed Mar 25 01:47:42.953344 2026] [:error] [pid 58154:tid 58163] [client 4.223.157.92:3026] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-png.php"] [unique_id "acLOPg0pGUh6bwD3ouKhDwAAAMY"]
[Wed Mar 25 01:47:43.486417 2026] [:error] [pid 57711:tid 58080] [client 4.223.157.92:10886] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-png.php"] [unique_id "acLOP6LdPFdeRRktTdNiwAAAAJg"]
[Wed Mar 25 01:47:44.020916 2026] [:error] [pid 58154:tid 58170] [client 4.223.157.92:10967] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-png.php"] [unique_id "acLOQA0pGUh6bwD3ouKhFgAAAM0"]
[Wed Mar 25 01:47:44.556177 2026] [:error] [pid 58154:tid 58171] [client 4.223.157.92:10999] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-png.php"] [unique_id "acLOQA0pGUh6bwD3ouKhGgAAAM4"]
[Wed Mar 25 01:47:45.089324 2026] [:error] [pid 57703:tid 58034] [client 4.223.157.92:10905] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acLOQfIVQxDtjkklWGZg_wAAAE8"]
[Wed Mar 25 01:47:45.624024 2026] [:error] [pid 58154:tid 58181] [client 4.223.157.92:3042] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acLOQQ0pGUh6bwD3ouKhHAAAANg"]
[Wed Mar 25 01:47:46.153584 2026] [:error] [pid 57702:tid 57912] [client 4.223.157.92:3022] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acLOQqS8TU_xcQFvlnYPpgAAAAk"]
[Wed Mar 25 01:47:46.685179 2026] [:error] [pid 57703:tid 58030] [client 4.223.157.92:3008] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acLOQvIVQxDtjkklWGZhAwAAAEs"]
[Wed Mar 25 01:47:47.219103 2026] [:error] [pid 58154:tid 58170] [client 4.223.157.92:2971] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acLOQw0pGUh6bwD3ouKhHwAAAM0"]
[Wed Mar 25 01:47:47.747990 2026] [:error] [pid 57711:tid 58076] [client 4.223.157.92:2945] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acLOQ6LdPFdeRRktTdNiwgAAAJY"]
[Wed Mar 25 01:47:48.285749 2026] [:error] [pid 57711:tid 58066] [client 4.223.157.92:10898] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acLORKLdPFdeRRktTdNixQAAAIw"]
[Wed Mar 25 01:47:48.823899 2026] [:error] [pid 58154:tid 58162] [client 4.223.157.92:3029] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acLORA0pGUh6bwD3ouKhIgAAAMU"]
[Wed Mar 25 01:47:49.360070 2026] [:error] [pid 57703:tid 58041] [client 4.223.157.92:10983] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acLORfIVQxDtjkklWGZhBgAAAFY"]
[Wed Mar 25 01:47:49.891783 2026] [:error] [pid 20371:tid 20382] [client 4.223.157.92:10975] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acLOReb25OL4yTv2fF-V4wAAAQk"]
[Wed Mar 25 01:47:50.428281 2026] [:error] [pid 57702:tid 57921] [client 4.223.157.92:10917] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acLORqS8TU_xcQFvlnYPsQAAABI"]
[Wed Mar 25 01:47:50.955454 2026] [:error] [pid 57702:tid 57917] [client 4.223.157.92:11007] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acLORqS8TU_xcQFvlnYPsgAAAA4"]
[Wed Mar 25 01:47:51.481885 2026] [:error] [pid 20371:tid 20376] [client 4.223.157.92:3071] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acLOR-b25OL4yTv2fF-V5gAAAQM"]
[Wed Mar 25 01:47:52.010405 2026] [:error] [pid 57703:tid 58034] [client 4.223.157.92:3070] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acLOSPIVQxDtjkklWGZhCwAAAE8"]
[Wed Mar 25 01:47:52.538975 2026] [:error] [pid 20371:tid 20387] [client 4.223.157.92:2984] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acLOSOb25OL4yTv2fF-V6QAAAQ4"]
[Wed Mar 25 01:47:53.084447 2026] [:error] [pid 57702:tid 57919] [client 4.223.157.92:10929] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acLOSaS8TU_xcQFvlnYPtwAAABA"]
[Wed Mar 25 01:47:53.609494 2026] [:error] [pid 57711:tid 58073] [client 4.223.157.92:3032] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acLOSaLdPFdeRRktTdNiygAAAJM"]
[Wed Mar 25 01:47:54.145790 2026] [:error] [pid 20371:tid 20391] [client 4.223.157.92:3014] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acLOSub25OL4yTv2fF-V7AAAARI"]
[Wed Mar 25 01:47:54.678046 2026] [:error] [pid 20371:tid 20396] [client 4.223.157.92:3034] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acLOSub25OL4yTv2fF-V7wAAARc"]
[Wed Mar 25 01:47:55.210524 2026] [:error] [pid 57702:tid 57918] [client 4.223.157.92:3012] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acLOS6S8TU_xcQFvlnYPvAAAAA8"]
[Wed Mar 25 01:47:55.743511 2026] [:error] [pid 20371:tid 20396] [client 4.223.157.92:10915] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acLOS-b25OL4yTv2fF-V-wAAARc"]
[Wed Mar 25 01:47:56.275510 2026] [:error] [pid 58154:tid 58169] [client 4.223.157.92:3058] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acLOTA0pGUh6bwD3ouKhKgAAAMw"]
[Wed Mar 25 01:47:58.202880 2026] [:error] [pid 57702:tid 57921] [client 4.223.157.92:2981] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acLOTqS8TU_xcQFvlnYPzgAAABI"]
[Wed Mar 25 01:47:58.735399 2026] [:error] [pid 57702:tid 57924] [client 4.223.157.92:3038] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acLOTqS8TU_xcQFvlnYP1wAAABU"]
[Wed Mar 25 01:47:59.269246 2026] [:error] [pid 58154:tid 58171] [client 4.223.157.92:3019] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ajax.php"] [unique_id "acLOTw0pGUh6bwD3ouKhPgAAAM4"]
[Wed Mar 25 01:47:59.797169 2026] [:error] [pid 58154:tid 58165] [client 4.223.157.92:10914] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ajax.php"] [unique_id "acLOTw0pGUh6bwD3ouKhQgAAAMg"]
[Wed Mar 25 01:48:00.325602 2026] [:error] [pid 57703:tid 58032] [client 4.223.157.92:10939] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ajax.php"] [unique_id "acLOUPIVQxDtjkklWGZhDwAAAE0"]
[Wed Mar 25 01:48:00.857133 2026] [:error] [pid 58154:tid 58170] [client 4.223.157.92:2959] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ajax.php"] [unique_id "acLOUA0pGUh6bwD3ouKhUQAAAM0"]
[Wed Mar 25 01:48:01.382381 2026] [:error] [pid 57703:tid 58026] [client 4.223.157.92:3005] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "acLOUfIVQxDtjkklWGZhEwAAAEc"]
[Wed Mar 25 01:48:01.925825 2026] [:error] [pid 57703:tid 58038] [client 4.223.157.92:3061] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "acLOUfIVQxDtjkklWGZhFAAAAFM"]
[Wed Mar 25 01:48:02.452564 2026] [:error] [pid 57703:tid 58034] [client 4.223.157.92:2997] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "acLOUvIVQxDtjkklWGZhFwAAAE8"]
[Wed Mar 25 01:48:02.981926 2026] [:error] [pid 58154:tid 58173] [client 4.223.157.92:10902] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "acLOUg0pGUh6bwD3ouKhVgAAANA"]
[Wed Mar 25 01:48:03.512315 2026] [:error] [pid 57711:tid 58062] [client 4.223.157.92:2978] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acLOU6LdPFdeRRktTdNi0AAAAIk"]
[Wed Mar 25 01:48:04.043639 2026] [:error] [pid 58154:tid 58162] [client 4.223.157.92:3062] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acLOVA0pGUh6bwD3ouKhWgAAAMU"]
[Wed Mar 25 01:48:04.586274 2026] [:error] [pid 58154:tid 58160] [client 4.223.157.92:3055] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acLOVA0pGUh6bwD3ouKhXwAAAMM"]
[Wed Mar 25 01:48:05.118910 2026] [:error] [pid 58154:tid 58166] [client 4.223.157.92:3023] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acLOVQ0pGUh6bwD3ouKhYgAAAMk"]
[Wed Mar 25 01:48:05.652457 2026] [:error] [pid 20371:tid 20380] [client 4.223.157.92:10976] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acLOVeb25OL4yTv2fF-WPwAAAQc"]
[Wed Mar 25 01:48:06.186874 2026] [:error] [pid 20371:tid 20386] [client 4.223.157.92:3016] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acLOVub25OL4yTv2fF-WQgAAAQ0"]
[Wed Mar 25 01:48:06.718413 2026] [:error] [pid 20371:tid 20389] [client 4.223.157.92:10885] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acLOVub25OL4yTv2fF-WSQAAARA"]
[Wed Mar 25 01:48:07.247113 2026] [:error] [pid 20371:tid 20387] [client 4.223.157.92:3025] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acLOV-b25OL4yTv2fF-WTQAAAQ4"]
[Wed Mar 25 01:48:07.797279 2026] [:error] [pid 57702:tid 57915] [client 4.223.157.92:3015] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acLOV6S8TU_xcQFvlnYP5AAAAAw"]
[Wed Mar 25 01:48:08.322671 2026] [:error] [pid 20371:tid 20384] [client 4.223.157.92:3069] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acLOWOb25OL4yTv2fF-WUwAAAQs"]
[Wed Mar 25 01:48:08.900865 2026] [:error] [pid 58154:tid 58166] [client 4.223.157.92:3057] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acLOWA0pGUh6bwD3ouKhawAAAMk"]
[Wed Mar 25 01:48:09.438051 2026] [:error] [pid 20371:tid 20395] [client 4.223.157.92:2979] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acLOWeb25OL4yTv2fF-WVgAAARY"]
[Wed Mar 25 01:48:09.977508 2026] [:error] [pid 20371:tid 20386] [client 4.223.157.92:10996] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/drhunthq.php"] [unique_id "acLOWeb25OL4yTv2fF-WWQAAAQ0"]
[Wed Mar 25 01:48:10.513049 2026] [:error] [pid 58154:tid 58163] [client 4.223.157.92:10926] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/drhunthq.php"] [unique_id "acLOWg0pGUh6bwD3ouKhcwAAAMY"]
[Wed Mar 25 01:48:11.041813 2026] [:error] [pid 57703:tid 58021] [client 4.223.157.92:3050] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/drhunthq.php"] [unique_id "acLOW_IVQxDtjkklWGZhHwAAAEI"]
[Wed Mar 25 01:48:11.574337 2026] [:error] [pid 20371:tid 20388] [client 4.223.157.92:3049] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/drhunthq.php"] [unique_id "acLOW-b25OL4yTv2fF-WYgAAAQ8"]
[Wed Mar 25 01:48:12.128214 2026] [:error] [pid 58154:tid 58169] [client 4.223.157.92:2996] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acLOXA0pGUh6bwD3ouKheAAAAMw"]
[Wed Mar 25 01:48:12.658700 2026] [:error] [pid 20371:tid 20392] [client 4.223.157.92:10933] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acLOXOb25OL4yTv2fF-WagAAARM"]
[Wed Mar 25 01:48:13.191246 2026] [:error] [pid 57702:tid 57904] [client 4.223.157.92:10922] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acLOXaS8TU_xcQFvlnYP6QAAAAE"]
[Wed Mar 25 01:48:13.715940 2026] [:error] [pid 20371:tid 20382] [client 4.223.157.92:3060] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acLOXeb25OL4yTv2fF-WcQAAAQk"]
[Wed Mar 25 01:48:14.270061 2026] [:error] [pid 58154:tid 58162] [client 4.223.157.92:2951] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a4.php"] [unique_id "acLOXg0pGUh6bwD3ouKhewAAAMU"]
[Wed Mar 25 01:48:14.806203 2026] [:error] [pid 20371:tid 20389] [client 4.223.157.92:10963] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a4.php"] [unique_id "acLOXub25OL4yTv2fF-WdwAAARA"]
[Wed Mar 25 01:48:15.337793 2026] [:error] [pid 58154:tid 58177] [client 4.223.157.92:2964] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a4.php"] [unique_id "acLOXw0pGUh6bwD3ouKhfwAAANQ"]
[Wed Mar 25 01:48:15.870441 2026] [:error] [pid 57702:tid 57913] [client 4.223.157.92:2899] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a4.php"] [unique_id "acLOX6S8TU_xcQFvlnYP6gAAAAo"]
[Wed Mar 25 01:48:16.415353 2026] [:error] [pid 20371:tid 20393] [client 4.223.157.92:11000] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wen.php"] [unique_id "acLOYOb25OL4yTv2fF-WegAAARQ"]
[Wed Mar 25 01:48:16.946719 2026] [:error] [pid 57702:tid 57908] [client 4.223.157.92:3054] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wen.php"] [unique_id "acLOYKS8TU_xcQFvlnYP6wAAAAU"]
[Wed Mar 25 01:48:17.482769 2026] [:error] [pid 57711:tid 58074] [client 4.223.157.92:2886] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wen.php"] [unique_id "acLOYaLdPFdeRRktTdNi1QAAAJQ"]
[Wed Mar 25 01:48:18.008860 2026] [:error] [pid 57711:tid 58069] [client 4.223.157.92:3000] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wen.php"] [unique_id "acLOYqLdPFdeRRktTdNi1gAAAI8"]
[Wed Mar 25 01:48:18.553993 2026] [:error] [pid 57711:tid 58073] [client 4.223.157.92:3051] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms.php"] [unique_id "acLOYqLdPFdeRRktTdNi2AAAAJM"]
[Wed Mar 25 01:48:19.082935 2026] [:error] [pid 58154:tid 58160] [client 4.223.157.92:3052] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms.php"] [unique_id "acLOYw0pGUh6bwD3ouKhigAAAMM"]
[Wed Mar 25 01:48:19.619594 2026] [:error] [pid 57703:tid 58037] [client 4.223.157.92:2948] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms.php"] [unique_id "acLOY_IVQxDtjkklWGZhKAAAAFI"]
[Wed Mar 25 01:48:20.146592 2026] [:error] [pid 57703:tid 58042] [client 4.223.157.92:2985] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms.php"] [unique_id "acLOZPIVQxDtjkklWGZhKQAAAFc"]
[Wed Mar 25 01:48:20.682944 2026] [:error] [pid 57703:tid 58031] [client 4.223.157.92:2895] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acLOZPIVQxDtjkklWGZhKwAAAEw"]
[Wed Mar 25 01:48:21.210889 2026] [:error] [pid 57702:tid 57916] [client 4.223.157.92:2941] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acLOZaS8TU_xcQFvlnYP9gAAAA0"]
[Wed Mar 25 01:48:21.754885 2026] [:error] [pid 57703:tid 58032] [client 4.223.157.92:2947] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acLOZfIVQxDtjkklWGZhLwAAAE0"]
[Wed Mar 25 01:48:22.286959 2026] [:error] [pid 57702:tid 57912] [client 4.223.157.92:10986] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acLOZqS8TU_xcQFvlnYP9wAAAAk"]
[Wed Mar 25 01:48:22.832056 2026] [:error] [pid 57702:tid 57906] [client 4.223.157.92:3041] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acLOZqS8TU_xcQFvlnYP-gAAAAM"]
[Wed Mar 25 01:48:23.358640 2026] [:error] [pid 57702:tid 57910] [client 4.223.157.92:10913] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acLOZ6S8TU_xcQFvlnYP_AAAAAc"]
[Wed Mar 25 01:48:23.914758 2026] [:error] [pid 20371:tid 20376] [client 4.223.157.92:2994] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acLOZ-b25OL4yTv2fF-WgQAAAQM"]
[Wed Mar 25 01:48:24.449647 2026] [:error] [pid 57703:tid 58023] [client 4.223.157.92:2921] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tfm.php"] [unique_id "acLOaPIVQxDtjkklWGZhNAAAAEQ"]
[Wed Mar 25 01:48:25.007264 2026] [:error] [pid 58154:tid 58168] [client 4.223.157.92:3036] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acLOaQ0pGUh6bwD3ouKhjQAAAMs"]
[Wed Mar 25 01:48:25.540925 2026] [:error] [pid 58154:tid 58178] [client 4.223.157.92:3018] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acLOaQ0pGUh6bwD3ouKhjgAAANU"]
[Wed Mar 25 01:48:26.077761 2026] [:error] [pid 57703:tid 58033] [client 4.223.157.92:3046] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acLOavIVQxDtjkklWGZhNQAAAE4"]
[Wed Mar 25 01:48:26.605752 2026] [:error] [pid 57702:tid 57922] [client 4.223.157.92:3031] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acLOaqS8TU_xcQFvlnYP_QAAABM"]
[Wed Mar 25 01:48:27.142818 2026] [:error] [pid 57702:tid 57920] [client 4.223.157.92:3067] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/term.php"] [unique_id "acLOa6S8TU_xcQFvlnYP_wAAABE"]
[Wed Mar 25 01:48:27.674988 2026] [:error] [pid 58154:tid 58163] [client 4.223.157.92:2977] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/term.php"] [unique_id "acLOaw0pGUh6bwD3ouKhlgAAAMY"]
[Wed Mar 25 01:48:28.386628 2026] [:error] [pid 58154:tid 58176] [client 4.223.157.92:3035] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/term.php"] [unique_id "acLObA0pGUh6bwD3ouKhmQAAANM"]
[Wed Mar 25 01:49:18.690177 2026] [:error] [pid 20371:tid 20394] [client 4.223.157.92:3068] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/166.php"] [unique_id "acLOnub25OL4yTv2fF-WvQAAARU"]
[Wed Mar 25 01:49:19.221747 2026] [:error] [pid 57703:tid 58040] [client 4.223.157.92:2960] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/166.php"] [unique_id "acLOn_IVQxDtjkklWGZhRAAAAFU"]
[Wed Mar 25 01:49:19.760760 2026] [:error] [pid 57702:tid 57917] [client 4.223.157.92:2933] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/166.php"] [unique_id "acLOn6S8TU_xcQFvlnYQFQAAAA4"]
[Wed Mar 25 01:49:20.290212 2026] [:error] [pid 57702:tid 57920] [client 4.223.157.92:2998] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/166.php"] [unique_id "acLOoKS8TU_xcQFvlnYQFgAAABE"]
[Wed Mar 25 01:49:20.820503 2026] [:error] [pid 57702:tid 57925] [client 4.223.157.92:3063] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acLOoKS8TU_xcQFvlnYQGAAAABY"]
[Wed Mar 25 01:49:21.350769 2026] [:error] [pid 57702:tid 57904] [client 4.223.157.92:10978] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acLOoaS8TU_xcQFvlnYQGwAAAAE"]
[Wed Mar 25 01:49:21.877784 2026] [:error] [pid 58154:tid 58169] [client 4.223.157.92:2928] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acLOoQ0pGUh6bwD3ouKhuwAAAMw"]
[Wed Mar 25 01:49:22.405661 2026] [:error] [pid 57711:tid 58073] [client 4.223.157.92:3004] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acLOoqLdPFdeRRktTdNi7QAAAJM"]
[Wed Mar 25 01:49:22.936804 2026] [:error] [pid 57702:tid 57911] [client 4.223.157.92:2920] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/grsiuk.php"] [unique_id "acLOoqS8TU_xcQFvlnYQHwAAAAg"]
[Wed Mar 25 01:49:23.466621 2026] [:error] [pid 57703:tid 58026] [client 4.223.157.92:2890] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/grsiuk.php"] [unique_id "acLOo_IVQxDtjkklWGZhSQAAAEc"]
[Wed Mar 25 01:49:23.993547 2026] [:error] [pid 57702:tid 57919] [client 4.223.157.92:2896] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/grsiuk.php"] [unique_id "acLOo6S8TU_xcQFvlnYQIQAAABA"]
[Wed Mar 25 01:49:24.526182 2026] [:error] [pid 20371:tid 20380] [client 4.223.157.92:2983] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/grsiuk.php"] [unique_id "acLOpOb25OL4yTv2fF-WwQAAAQc"]
[Wed Mar 25 01:49:25.051829 2026] [:error] [pid 20371:tid 20385] [client 4.223.157.92:10932] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acLOpeb25OL4yTv2fF-WwgAAAQw"]
[Wed Mar 25 01:49:25.583172 2026] [:error] [pid 57711:tid 58058] [client 4.223.157.92:2931] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acLOpaLdPFdeRRktTdNi7wAAAIY"]
[Wed Mar 25 01:49:26.115257 2026] [:error] [pid 20371:tid 20396] [client 4.223.157.92:2962] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acLOpub25OL4yTv2fF-WxgAAARc"]
[Wed Mar 25 01:49:26.641092 2026] [:error] [pid 57711:tid 58060] [client 4.223.157.92:10942] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acLOpqLdPFdeRRktTdNi8AAAAIg"]
[Wed Mar 25 01:49:27.169011 2026] [:error] [pid 57703:tid 58023] [client 4.223.157.92:2821] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cu.php"] [unique_id "acLOp_IVQxDtjkklWGZhTgAAAEQ"]
[Wed Mar 25 01:49:27.697658 2026] [:error] [pid 57702:tid 57922] [client 4.223.157.92:2884] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cu.php"] [unique_id "acLOp6S8TU_xcQFvlnYQJQAAABM"]
[Wed Mar 25 01:49:28.236512 2026] [:error] [pid 20371:tid 20393] [client 4.223.157.92:2990] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cu.php"] [unique_id "acLOqOb25OL4yTv2fF-WyQAAARQ"]
[Wed Mar 25 01:49:28.773906 2026] [:error] [pid 20371:tid 20387] [client 4.223.157.92:10993] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cu.php"] [unique_id "acLOqOb25OL4yTv2fF-WygAAAQ4"]
[Wed Mar 25 01:49:29.301640 2026] [:error] [pid 20371:tid 20375] [client 4.223.157.92:2954] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/8.php"] [unique_id "acLOqeb25OL4yTv2fF-WywAAAQI"]
[Wed Mar 25 01:49:29.831374 2026] [:error] [pid 20371:tid 20397] [client 4.223.157.92:10949] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/8.php"] [unique_id "acLOqeb25OL4yTv2fF-WzAAAARg"]
[Wed Mar 25 01:49:30.357411 2026] [:error] [pid 20371:tid 20384] [client 4.223.157.92:2950] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/8.php"] [unique_id "acLOqub25OL4yTv2fF-WzQAAAQs"]
[Wed Mar 25 01:49:30.896430 2026] [:error] [pid 20371:tid 20395] [client 4.223.157.92:2839] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/8.php"] [unique_id "acLOqub25OL4yTv2fF-WzgAAARY"]
[Wed Mar 25 01:49:31.428185 2026] [:error] [pid 20371:tid 20380] [client 4.223.157.92:2963] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws60.php"] [unique_id "acLOq-b25OL4yTv2fF-W0QAAAQc"]
[Wed Mar 25 01:49:31.956170 2026] [:error] [pid 20371:tid 20386] [client 4.223.157.92:2956] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws60.php"] [unique_id "acLOq-b25OL4yTv2fF-W0gAAAQ0"]
[Wed Mar 25 01:49:32.490282 2026] [:error] [pid 57703:tid 58033] [client 4.223.157.92:3007] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws60.php"] [unique_id "acLOrPIVQxDtjkklWGZhTwAAAE4"]
[Wed Mar 25 01:49:33.024421 2026] [:error] [pid 57702:tid 57921] [client 4.223.157.92:3047] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws60.php"] [unique_id "acLOraS8TU_xcQFvlnYQJgAAABI"]
[Wed Mar 25 01:49:33.574294 2026] [:error] [pid 58154:tid 58159] [client 4.223.157.92:2829] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vanda.php"] [unique_id "acLOrQ0pGUh6bwD3ouKhvwAAAMI"]
[Wed Mar 25 01:49:34.100430 2026] [:error] [pid 20371:tid 20381] [client 4.223.157.92:2897] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vanda.php"] [unique_id "acLOrub25OL4yTv2fF-W0wAAAQg"]
[Wed Mar 25 01:49:34.630845 2026] [:error] [pid 20371:tid 20389] [client 4.223.157.92:2965] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vanda.php"] [unique_id "acLOrub25OL4yTv2fF-W1AAAARA"]
[Wed Mar 25 01:49:35.161945 2026] [:error] [pid 20371:tid 20383] [client 4.223.157.92:2908] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vanda.php"] [unique_id "acLOr-b25OL4yTv2fF-W1QAAAQo"]
[Wed Mar 25 01:49:35.690113 2026] [:error] [pid 57702:tid 57908] [client 4.223.157.92:2946] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/domains.php"] [unique_id "acLOr6S8TU_xcQFvlnYQKAAAAAU"]
[Wed Mar 25 01:49:36.293862 2026] [:error] [pid 57702:tid 57912] [client 4.223.157.92:10982] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/domains.php"] [unique_id "acLOsKS8TU_xcQFvlnYQKQAAAAk"]
[Wed Mar 25 01:49:36.820698 2026] [:error] [pid 57702:tid 57923] [client 4.223.157.92:2942] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/domains.php"] [unique_id "acLOsKS8TU_xcQFvlnYQKwAAABQ"]
[Wed Mar 25 01:49:37.349744 2026] [:error] [pid 20371:tid 20388] [client 4.223.157.92:11003] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/domains.php"] [unique_id "acLOseb25OL4yTv2fF-W2QAAAQ8"]
[Wed Mar 25 01:49:37.884264 2026] [:error] [pid 20371:tid 20379] [client 4.223.157.92:2826] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/144.php"] [unique_id "acLOseb25OL4yTv2fF-W2wAAAQY"]
[Wed Mar 25 01:49:38.410161 2026] [:error] [pid 57711:tid 58062] [client 4.223.157.92:2949] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/144.php"] [unique_id "acLOsqLdPFdeRRktTdNi8wAAAIk"]
[Wed Mar 25 01:49:38.945833 2026] [:error] [pid 57702:tid 57905] [client 4.223.157.92:2995] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/144.php"] [unique_id "acLOsqS8TU_xcQFvlnYQLAAAAAI"]
[Wed Mar 25 01:49:39.486899 2026] [:error] [pid 57711:tid 58066] [client 4.223.157.92:2912] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/144.php"] [unique_id "acLOs6LdPFdeRRktTdNi9AAAAIw"]
[Wed Mar 25 01:49:40.023767 2026] [:error] [pid 20371:tid 20375] [client 4.223.157.92:2975] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asd.php"] [unique_id "acLOtOb25OL4yTv2fF-W3QAAAQI"]
[Wed Mar 25 01:49:40.554306 2026] [:error] [pid 58154:tid 58170] [client 4.223.157.92:2974] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asd.php"] [unique_id "acLOtA0pGUh6bwD3ouKhwQAAAM0"]
[Wed Mar 25 01:49:41.083353 2026] [:error] [pid 20371:tid 20397] [client 4.223.157.92:2929] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asd.php"] [unique_id "acLOteb25OL4yTv2fF-W3wAAARg"]
[Wed Mar 25 01:49:41.617691 2026] [:error] [pid 20371:tid 20384] [client 4.223.157.92:2966] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asd.php"] [unique_id "acLOteb25OL4yTv2fF-W4AAAAQs"]
[Wed Mar 25 01:49:42.154536 2026] [:error] [pid 20371:tid 20380] [client 4.223.157.92:2934] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zc-104.php"] [unique_id "acLOtub25OL4yTv2fF-W4wAAAQc"]
[Wed Mar 25 01:49:42.687900 2026] [:error] [pid 57703:tid 58025] [client 4.223.157.92:2892] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zc-104.php"] [unique_id "acLOtvIVQxDtjkklWGZhUAAAAEY"]
[Wed Mar 25 01:49:43.228841 2026] [:error] [pid 20371:tid 20373] [client 4.223.157.92:2999] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zc-104.php"] [unique_id "acLOt-b25OL4yTv2fF-W5QAAAQA"]
[Wed Mar 25 01:49:43.764738 2026] [:error] [pid 57702:tid 57903] [client 4.223.157.92:3003] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zc-104.php"] [unique_id "acLOt6S8TU_xcQFvlnYQLgAAAAA"]
[Wed Mar 25 01:49:44.292397 2026] [:error] [pid 20371:tid 20389] [client 4.223.157.92:2893] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rzki.php"] [unique_id "acLOuOb25OL4yTv2fF-W5wAAARA"]
[Wed Mar 25 01:49:44.817308 2026] [:error] [pid 57702:tid 57906] [client 4.223.157.92:2976] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rzki.php"] [unique_id "acLOuKS8TU_xcQFvlnYQLwAAAAM"]
[Wed Mar 25 01:49:45.369791 2026] [:error] [pid 20371:tid 20393] [client 4.223.157.92:2989] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rzki.php"] [unique_id "acLOueb25OL4yTv2fF-W6wAAARQ"]
[Wed Mar 25 01:49:45.895128 2026] [:error] [pid 57703:tid 58036] [client 4.223.157.92:2955] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rzki.php"] [unique_id "acLOufIVQxDtjkklWGZhUgAAAFE"]
[Wed Mar 25 01:49:47.436741 2026] [:error] [pid 57711:tid 58052] [client 4.223.157.92:2894] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "acLOu6LdPFdeRRktTdNi9wAAAII"]
[Wed Mar 25 01:49:47.974205 2026] [:error] [pid 20371:tid 20392] [client 4.223.157.92:3040] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "acLOu-b25OL4yTv2fF-W7QAAARM"]
[Wed Mar 25 01:49:48.506359 2026] [:error] [pid 57711:tid 58059] [client 4.223.157.92:2866] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "acLOvKLdPFdeRRktTdNi-AAAAIc"]
[Wed Mar 25 01:49:49.055702 2026] [:error] [pid 57711:tid 58070] [client 4.223.157.92:2938] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "acLOvaLdPFdeRRktTdNi-QAAAJA"]
[Wed Mar 25 01:49:49.591617 2026] [:error] [pid 57703:tid 58020] [client 4.223.157.92:10938] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/d12.php"] [unique_id "acLOvfIVQxDtjkklWGZhVQAAAEE"]
[Wed Mar 25 01:49:50.143843 2026] [:error] [pid 20371:tid 20397] [client 4.223.157.92:3037] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/d12.php"] [unique_id "acLOvub25OL4yTv2fF-W8AAAARg"]
[Wed Mar 25 01:49:50.680971 2026] [:error] [pid 20371:tid 20384] [client 4.223.157.92:2907] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/d12.php"] [unique_id "acLOvub25OL4yTv2fF-W8QAAAQs"]
[Wed Mar 25 01:49:51.222344 2026] [:error] [pid 57711:tid 58068] [client 4.223.157.92:2822] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/d12.php"] [unique_id "acLOv6LdPFdeRRktTdNi-wAAAI4"]
[Wed Mar 25 01:49:51.752694 2026] [:error] [pid 57702:tid 57922] [client 4.223.157.92:10889] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/okxh.php"] [unique_id "acLOv6S8TU_xcQFvlnYQMgAAABM"]
[Wed Mar 25 01:49:52.290882 2026] [:error] [pid 20371:tid 20380] [client 4.223.157.92:3045] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/okxh.php"] [unique_id "acLOwOb25OL4yTv2fF-W8gAAAQc"]
[Wed Mar 25 01:49:52.823076 2026] [:error] [pid 57711:tid 58064] [client 4.223.157.92:2820] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/okxh.php"] [unique_id "acLOwKLdPFdeRRktTdNi_AAAAIs"]
[Wed Mar 25 01:49:53.357147 2026] [:error] [pid 20371:tid 20386] [client 4.223.157.92:2927] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/okxh.php"] [unique_id "acLOweb25OL4yTv2fF-W9AAAAQ0"]
[Wed Mar 25 01:49:53.895167 2026] [:error] [pid 20371:tid 20389] [client 4.223.157.92:2889] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/55b76.php"] [unique_id "acLOweb25OL4yTv2fF-W9QAAARA"]
[Wed Mar 25 01:49:54.435024 2026] [:error] [pid 20371:tid 20381] [client 4.223.157.92:2972] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/55b76.php"] [unique_id "acLOwub25OL4yTv2fF-W9gAAAQg"]
[Wed Mar 25 01:49:54.974884 2026] [:error] [pid 57702:tid 57910] [client 4.223.157.92:2831] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/55b76.php"] [unique_id "acLOwqS8TU_xcQFvlnYQMwAAAAc"]
[Wed Mar 25 01:49:55.502604 2026] [:error] [pid 57702:tid 57913] [client 4.223.157.92:2824] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/55b76.php"] [unique_id "acLOw6S8TU_xcQFvlnYQNAAAAAo"]
[Wed Mar 25 01:49:56.043424 2026] [:error] [pid 57711:tid 58055] [client 4.223.157.92:2883] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tt.php"] [unique_id "acLOxKLdPFdeRRktTdNi_wAAAIQ"]
[Wed Mar 25 01:49:56.575875 2026] [:error] [pid 57703:tid 58032] [client 4.223.157.92:2882] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tt.php"] [unique_id "acLOxPIVQxDtjkklWGZhVwAAAE0"]
[Wed Mar 25 01:49:57.103880 2026] [:error] [pid 57703:tid 58043] [client 4.223.157.92:2883] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tt.php"] [unique_id "acLOxfIVQxDtjkklWGZhWgAAAFg"]
[Wed Mar 25 01:49:57.636565 2026] [:error] [pid 57711:tid 58080] [client 4.223.157.92:2863] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tt.php"] [unique_id "acLOxaLdPFdeRRktTdNjAAAAAJg"]
[Wed Mar 25 01:49:58.165577 2026] [:error] [pid 20371:tid 20383] [client 4.223.157.92:3013] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maul.php"] [unique_id "acLOxub25OL4yTv2fF-W9wAAAQo"]
[Wed Mar 25 01:49:58.698327 2026] [:error] [pid 57711:tid 58076] [client 4.223.157.92:2930] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maul.php"] [unique_id "acLOxqLdPFdeRRktTdNjAgAAAJY"]
[Wed Mar 25 01:49:59.228701 2026] [:error] [pid 57711:tid 58062] [client 4.223.157.92:2901] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maul.php"] [unique_id "acLOx6LdPFdeRRktTdNjAwAAAIk"]
[Wed Mar 25 01:49:59.764083 2026] [:error] [pid 20371:tid 20393] [client 4.223.157.92:2919] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maul.php"] [unique_id "acLOx-b25OL4yTv2fF-W-gAAARQ"]
[Wed Mar 25 01:50:00.295084 2026] [:error] [pid 57711:tid 58051] [client 4.223.157.92:2957] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acLOyKLdPFdeRRktTdNjBQAAAIE"]
[Wed Mar 25 01:50:00.836779 2026] [:error] [pid 57703:tid 58035] [client 4.223.157.92:2958] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acLOyPIVQxDtjkklWGZhWwAAAFA"]
[Wed Mar 25 01:50:01.363991 2026] [:error] [pid 57711:tid 58052] [client 4.223.157.92:2905] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acLOyaLdPFdeRRktTdNjBgAAAII"]
[Wed Mar 25 01:50:01.937364 2026] [:error] [pid 57703:tid 58034] [client 4.223.157.92:2818] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acLOyfIVQxDtjkklWGZhXgAAAE8"]
[Wed Mar 25 01:50:02.467840 2026] [:error] [pid 57711:tid 58075] [client 4.223.157.92:2850] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acLOyqLdPFdeRRktTdNjBwAAAJU"]
[Wed Mar 25 01:50:03.016297 2026] [:error] [pid 57711:tid 58059] [client 4.223.157.92:2843] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acLOy6LdPFdeRRktTdNjCAAAAIc"]
[Wed Mar 25 01:50:03.545125 2026] [:error] [pid 20371:tid 20397] [client 4.223.157.92:2849] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acLOy-b25OL4yTv2fF-W_wAAARg"]
[Wed Mar 25 01:50:04.082085 2026] [:error] [pid 20371:tid 20384] [client 4.223.157.92:2880] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acLOzOb25OL4yTv2fF-XAAAAAQs"]
[Wed Mar 25 01:50:04.616091 2026] [:error] [pid 57703:tid 58024] [client 4.223.157.92:2973] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acLOzPIVQxDtjkklWGZhZgAAAEU"]
[Wed Mar 25 01:50:05.163891 2026] [:error] [pid 57711:tid 58070] [client 4.223.157.92:2967] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acLOzaLdPFdeRRktTdNjCQAAAJA"]
[Wed Mar 25 01:50:05.693456 2026] [:error] [pid 57711:tid 58050] [client 4.223.157.92:2881] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acLOzaLdPFdeRRktTdNjCgAAAIA"]
[Wed Mar 25 01:50:06.242452 2026] [:error] [pid 20371:tid 20375] [client 4.223.157.92:2910] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acLOzub25OL4yTv2fF-XAQAAAQI"]
[Wed Mar 25 01:50:06.783134 2026] [:error] [pid 58154:tid 58171] [client 4.223.157.92:2916] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/varb.php"] [unique_id "acLOzg0pGUh6bwD3ouKhxgAAAM4"]
[Wed Mar 25 01:50:07.317123 2026] [:error] [pid 57703:tid 58025] [client 4.223.157.92:2828] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/varb.php"] [unique_id "acLOz_IVQxDtjkklWGZhbgAAAEY"]
[Wed Mar 25 01:50:07.857044 2026] [:error] [pid 57703:tid 58036] [client 4.223.157.92:2885] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/varb.php"] [unique_id "acLOz_IVQxDtjkklWGZhcAAAAFE"]
[Wed Mar 25 01:50:08.395494 2026] [:error] [pid 57703:tid 58023] [client 4.223.157.92:2913] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/varb.php"] [unique_id "acLO0PIVQxDtjkklWGZhcgAAAEQ"]
[Wed Mar 25 01:50:08.933860 2026] [:error] [pid 57703:tid 58030] [client 4.223.157.92:2891] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lm15.php"] [unique_id "acLO0PIVQxDtjkklWGZhcwAAAEs"]
[Wed Mar 25 01:50:09.492269 2026] [:error] [pid 57703:tid 58020] [client 4.223.157.92:2900] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lm15.php"] [unique_id "acLO0fIVQxDtjkklWGZhdQAAAEE"]
[Wed Mar 25 01:50:10.022055 2026] [:error] [pid 57711:tid 58060] [client 4.223.157.92:2902] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lm15.php"] [unique_id "acLO0qLdPFdeRRktTdNjDgAAAIg"]
[Wed Mar 25 01:50:10.560271 2026] [:error] [pid 57711:tid 58080] [client 4.223.157.92:2924] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lm15.php"] [unique_id "acLO0qLdPFdeRRktTdNjEAAAAJg"]
[Wed Mar 25 01:50:11.089856 2026] [:error] [pid 57703:tid 58042] [client 4.223.157.92:10958] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/clss.php"] [unique_id "acLO0_IVQxDtjkklWGZheAAAAFc"]
[Wed Mar 25 01:50:11.616933 2026] [:error] [pid 20371:tid 20386] [client 4.223.157.92:2970] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/clss.php"] [unique_id "acLO0-b25OL4yTv2fF-XAgAAAQ0"]
[Wed Mar 25 01:50:12.159150 2026] [:error] [pid 20371:tid 20373] [client 4.223.157.92:3002] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/clss.php"] [unique_id "acLO1Ob25OL4yTv2fF-XAwAAAQA"]
[Wed Mar 25 01:50:12.704779 2026] [:error] [pid 57703:tid 58039] [client 4.223.157.92:2961] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/clss.php"] [unique_id "acLO1PIVQxDtjkklWGZhfAAAAFQ"]
[Wed Mar 25 01:50:13.247119 2026] [:error] [pid 57711:tid 58066] [client 4.223.157.92:2918] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/44.php"] [unique_id "acLO1aLdPFdeRRktTdNjEwAAAIw"]
[Wed Mar 25 01:50:13.789469 2026] [:error] [pid 57711:tid 58071] [client 4.223.157.92:2840] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/44.php"] [unique_id "acLO1aLdPFdeRRktTdNjFAAAAJE"]
[Wed Mar 25 01:50:14.316855 2026] [:error] [pid 57703:tid 58035] [client 4.223.157.92:2991] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/44.php"] [unique_id "acLO1vIVQxDtjkklWGZhfwAAAFA"]
[Wed Mar 25 01:50:14.863981 2026] [:error] [pid 20371:tid 20396] [client 4.223.157.92:3059] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/44.php"] [unique_id "acLO1ub25OL4yTv2fF-XBgAAARc"]
[Wed Mar 25 01:50:15.410673 2026] [:error] [pid 58154:tid 58162] [client 4.223.157.92:2911] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a5e0a.php"] [unique_id "acLO1w0pGUh6bwD3ouKhyAAAAMU"]
[Wed Mar 25 01:50:15.957529 2026] [:error] [pid 58154:tid 58161] [client 4.223.157.92:3006] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a5e0a.php"] [unique_id "acLO1w0pGUh6bwD3ouKhygAAAMQ"]
[Wed Mar 25 01:50:16.494002 2026] [:error] [pid 20371:tid 20383] [client 4.223.157.92:2761] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a5e0a.php"] [unique_id "acLO2Ob25OL4yTv2fF-XBwAAAQo"]
[Wed Mar 25 01:50:32.545872 2026] [:error] [pid 20371:tid 20379] [client 4.223.157.92:2898] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acLO6Ob25OL4yTv2fF-XMQAAAQY"]
[Wed Mar 25 01:50:33.171419 2026] [:error] [pid 57711:tid 58062] [client 4.223.157.92:2834] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acLO6aLdPFdeRRktTdNjHQAAAIk"]
[Wed Mar 25 01:50:33.944136 2026] [:error] [pid 57711:tid 58071] [client 4.223.157.92:2887] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acLO6aLdPFdeRRktTdNjIAAAAJE"]
[Wed Mar 25 01:50:34.564066 2026] [:error] [pid 57711:tid 58067] [client 4.223.157.92:2752] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acLO6qLdPFdeRRktTdNjIgAAAI0"]
[Wed Mar 25 01:50:35.140270 2026] [:error] [pid 58154:tid 58170] [client 4.223.157.92:2987] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gfd.php"] [unique_id "acLO6w0pGUh6bwD3ouKhzgAAAM0"]
[Wed Mar 25 01:50:35.679490 2026] [:error] [pid 58154:tid 58180] [client 4.223.157.92:3066] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gfd.php"] [unique_id "acLO6w0pGUh6bwD3ouKh0AAAANc"]
[Wed Mar 25 01:50:36.210583 2026] [:error] [pid 20371:tid 20382] [client 4.223.157.92:2842] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gfd.php"] [unique_id "acLO7Ob25OL4yTv2fF-XNAAAAQk"]
[Wed Mar 25 01:50:36.747453 2026] [:error] [pid 58154:tid 58165] [client 4.223.157.92:2940] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gfd.php"] [unique_id "acLO7A0pGUh6bwD3ouKh0gAAAMg"]
[Wed Mar 25 01:50:37.280514 2026] [:error] [pid 57711:tid 58070] [client 4.223.157.92:2800] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/callback.php"] [unique_id "acLO7aLdPFdeRRktTdNjJAAAAJA"]
[Wed Mar 25 01:50:37.827264 2026] [:error] [pid 58154:tid 58176] [client 4.223.157.92:3048] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/callback.php"] [unique_id "acLO7Q0pGUh6bwD3ouKh0wAAANM"]
[Wed Mar 25 01:50:38.373168 2026] [:error] [pid 57711:tid 58068] [client 4.223.157.92:2923] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/callback.php"] [unique_id "acLO7qLdPFdeRRktTdNjJQAAAI4"]
[Wed Mar 25 01:50:38.904662 2026] [:error] [pid 20371:tid 20395] [client 4.223.157.92:2992] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/callback.php"] [unique_id "acLO7ub25OL4yTv2fF-XNQAAARY"]
[Wed Mar 25 01:50:39.445173 2026] [:error] [pid 57711:tid 58054] [client 4.223.157.92:2952] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file.php"] [unique_id "acLO76LdPFdeRRktTdNjJgAAAIM"]
[Wed Mar 25 01:50:39.976926 2026] [:error] [pid 57702:tid 57924] [client 4.223.157.92:2762] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file.php"] [unique_id "acLO76S8TU_xcQFvlnYQOwAAABU"]
[Wed Mar 25 01:50:40.516516 2026] [:error] [pid 20371:tid 20386] [client 4.223.157.92:2926] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file.php"] [unique_id "acLO8Ob25OL4yTv2fF-XNwAAAQ0"]
[Wed Mar 25 01:50:41.072854 2026] [:error] [pid 57711:tid 58055] [client 4.223.157.92:3064] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file.php"] [unique_id "acLO8aLdPFdeRRktTdNjJwAAAIQ"]
[Wed Mar 25 01:50:41.614116 2026] [:error] [pid 57711:tid 58060] [client 4.223.157.92:2868] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acLO8aLdPFdeRRktTdNjKAAAAIg"]
[Wed Mar 25 01:50:42.164909 2026] [:error] [pid 57711:tid 58076] [client 4.223.157.92:2914] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acLO8qLdPFdeRRktTdNjKQAAAJY"]
[Wed Mar 25 01:50:42.713210 2026] [:error] [pid 57711:tid 58080] [client 4.223.157.92:2968] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acLO8qLdPFdeRRktTdNjKgAAAJg"]
[Wed Mar 25 01:50:43.260490 2026] [:error] [pid 57711:tid 58058] [client 4.223.157.92:2823] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acLO86LdPFdeRRktTdNjKwAAAIY"]
[Wed Mar 25 01:50:43.791533 2026] [:error] [pid 57711:tid 58074] [client 4.223.157.92:2871] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acLO86LdPFdeRRktTdNjLAAAAJQ"]
[Wed Mar 25 01:50:44.319179 2026] [:error] [pid 57703:tid 58019] [client 4.223.157.92:2936] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acLO9PIVQxDtjkklWGZhjQAAAEA"]
[Wed Mar 25 01:50:44.851043 2026] [:error] [pid 57711:tid 58071] [client 4.223.157.92:2787] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acLO9KLdPFdeRRktTdNjLwAAAJE"]
[Wed Mar 25 01:50:45.399856 2026] [:error] [pid 57702:tid 57927] [client 4.223.157.92:2838] [client 4.223.157.92] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acLO9aS8TU_xcQFvlnYQPQAAABg"]
[Wed Mar 25 05:34:32.918092 2026] [:error] [pid 47989:tid 48015] [client 148.72.173.218:52703] [client 148.72.173.218] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 148.72.173.218, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acMDaCWKdJMhIccROjlhOAAAAVg"]
[Wed Mar 25 05:34:32.918162 2026] [:error] [pid 47989:tid 48015] [client 148.72.173.218:52703] [client 148.72.173.218] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 148.72.173.218 on wp-login.php, counter = 63"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acMDaCWKdJMhIccROjlhOAAAAVg"]
[Wed Mar 25 06:05:06.694898 2026] [:error] [pid 47989:tid 47998] [client 94.55.229.180:24127] [client 94.55.229.180] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.55.229.180, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acMKkiWKdJMhIccROjlzBAAAAUc"]
[Wed Mar 25 07:59:52.152281 2026] [:error] [pid 756:tid 869] [client 173.239.240.90:36555] [client 173.239.240.90] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.90, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acMleDOaW6oylMIDBCTLHwAAAJE"]
[Wed Mar 25 12:57:46.163639 2026] [:error] [pid 756:tid 856] [client 173.239.240.133:31431] [client 173.239.240.133] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.133, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acNrSjOaW6oylMIDBCQE5gAAAIQ"]
[Wed Mar 25 14:20:00.606131 2026] [:error] [pid 25967:tid 25973] [client 122.168.80.73:19116] [client 122.168.80.73] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.168.80.73, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acN-kPg8Qtq7ZM4mSFnSuwAAA0E"]
[Wed Mar 25 16:14:20.080104 2026] [:error] [pid 47946:tid 47970] [client 115.186.169.142:61294] [client 115.186.169.142] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.186.169.142, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acOZXDipQTqBMSeKYhd2bAAAARY"]
[Wed Mar 25 16:18:43.950848 2026] [:error] [pid 26269:tid 26290] [client 84.54.78.188:31743] [client 84.54.78.188] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 84.54.78.188, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acOaY0n7e-ZQbaIs7qyo1AAAAY4"]
[Wed Mar 25 18:30:47.574644 2026] [:error] [pid 25967:tid 25974] [client 91.144.18.230:29553] [client 91.144.18.230] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.144.18.230, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acO5V_g8Qtq7ZM4mSFk7bQAAA0I"]
[Wed Mar 25 18:47:14.548906 2026] [:error] [pid 25875:tid 25890] [client 185.223.152.5:26389] [client 185.223.152.5] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.223.152.5, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acO9MhJ38QkS3Nyfshzm9wAAAok"]
[Wed Mar 25 20:38:07.666552 2026] [:error] [pid 25875:tid 25882] [client 4.223.157.191:13928] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acPXLxJ38QkS3NyfshwTBQAAAoE"]
[Wed Mar 25 20:38:08.193384 2026] [:error] [pid 47989:tid 47993] [client 4.223.157.191:13943] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acPXMCWKdJMhIccROjnwgQAAAUI"]
[Wed Mar 25 20:38:08.728554 2026] [:error] [pid 47946:tid 47963] [client 4.223.157.191:13924] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acPXMDipQTqBMSeKYheHWgAAAQ8"]
[Wed Mar 25 20:38:09.252691 2026] [:error] [pid 26449:tid 26453] [client 4.223.157.191:13853] [client 4.223.157.191] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acPXMdpZ2T15NDqzAjGDMQAAAkA"]
[Thu Mar 26 06:09:59.296067 2026] [:error] [pid 19712:tid 19798] [client 70.64.96.129:65450] [client 70.64.96.129] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 70.64.96.129, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acRdN9WhKhRNqm23vFO5qgAAAJY"]
[Thu Mar 26 06:11:51.384635 2026] [:error] [pid 60829:tid 60835] [client 177.124.34.67:15939] [client 177.124.34.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 177.124.34.67, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acRdp_TdjHKeZokybaTjUgAAAQQ"]
[Thu Mar 26 07:12:51.691079 2026] [:error] [pid 19712:tid 19796] [client 192.3.207.218:56466] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/artisan"] [unique_id "acRr89WhKhRNqm23vFPd6wAAAJQ"]
[Thu Mar 26 07:12:52.119472 2026] [:error] [pid 19818:tid 19831] [client 192.3.207.218:56924] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/artisan"] [unique_id "acRr9MzaSnm3d1BeM5WNYgAAAMs"]
[Thu Mar 26 07:12:53.197524 2026] [:error] [pid 19712:tid 19797] [client 192.3.207.218:57313] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/artisan"] [unique_id "acRr9dWhKhRNqm23vFPeDwAAAJU"]
[Thu Mar 26 07:12:53.621649 2026] [:error] [pid 19710:tid 19743] [client 192.3.207.218:57853] [client 192.3.207.218] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/artisan"] [unique_id "acRr9QVEWP8Ar68Njk6o4QAAABU"]
[Thu Mar 26 07:12:54.486210 2026] [:error] [pid 19710:tid 19723] [client 192.3.207.218:58179] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "acRr9gVEWP8Ar68Njk6pIgAAAAE"]
[Thu Mar 26 07:12:54.956895 2026] [:error] [pid 19710:tid 19745] [client 192.3.207.218:58870] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "acRr9gVEWP8Ar68Njk6pQwAAABc"]
[Thu Mar 26 07:12:55.831307 2026] [:error] [pid 19712:tid 19784] [client 192.3.207.218:59303] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.env"] [unique_id "acRr99WhKhRNqm23vFPeeAAAAIg"]
[Thu Mar 26 07:12:56.264347 2026] [:error] [pid 31670:tid 31683] [client 192.3.207.218:60264] [client 192.3.207.218] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.env"] [unique_id "acRr-DXVthXxCnWjOTQx7AAAAUs"]
[Thu Mar 26 14:13:56.226777 2026] [:error] [pid 19818:tid 19831] [client 106.51.148.10:12696] [client 106.51.148.10] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.51.148.10, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acTOpMzaSnm3d1BeM5VsegAAAMs"]
[Thu Mar 26 14:44:41.293534 2026] [:error] [pid 31778:tid 31813] [client 20.240.134.170:3982] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zcsu.php"] [unique_id "acTV2Q3kybI2o-xasmC95wAAAdQ"]
[Thu Mar 26 14:44:41.836809 2026] [:error] [pid 19818:tid 19823] [client 20.240.134.170:4054] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zcsu.php"] [unique_id "acTV2czaSnm3d1BeM5WA-wAAAMM"]
[Thu Mar 26 14:44:42.412174 2026] [:error] [pid 31780:tid 31820] [client 20.240.134.170:4062] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zcsu.php"] [unique_id "acTV2pJDwZsy5O4ZXEhLIwAAAgA"]
[Thu Mar 26 14:44:42.999364 2026] [:error] [pid 19818:tid 19822] [client 20.240.134.170:4066] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zcsu.php"] [unique_id "acTV2szaSnm3d1BeM5WBAQAAAMI"]
[Thu Mar 26 14:44:43.542111 2026] [:error] [pid 31780:tid 31822] [client 20.240.134.170:4075] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acTV25JDwZsy5O4ZXEhLJAAAAgI"]
[Thu Mar 26 14:44:44.279880 2026] [:error] [pid 19710:tid 19725] [client 20.240.134.170:3972] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acTV3AVEWP8Ar68Njk7fVwAAAAM"]
[Thu Mar 26 14:44:44.875647 2026] [:error] [pid 60829:tid 60844] [client 20.240.134.170:4081] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acTV3PTdjHKeZokybaSMAwAAAQ0"]
[Thu Mar 26 14:44:45.422873 2026] [:error] [pid 31670:tid 31689] [client 20.240.134.170:4084] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acTV3TXVthXxCnWjOTQQNwAAAVE"]
[Thu Mar 26 14:44:45.957442 2026] [:error] [pid 31670:tid 31679] [client 20.240.134.170:3994] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-cxs.php"] [unique_id "acTV3TXVthXxCnWjOTQQPQAAAUc"]
[Thu Mar 26 14:44:46.514340 2026] [:error] [pid 19818:tid 19836] [client 20.240.134.170:3984] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-cxs.php"] [unique_id "acTV3szaSnm3d1BeM5WBCwAAANA"]
[Thu Mar 26 14:44:47.131162 2026] [:error] [pid 19818:tid 19833] [client 20.240.134.170:4055] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-cxs.php"] [unique_id "acTV38zaSnm3d1BeM5WBDQAAAM0"]
[Thu Mar 26 14:44:47.671115 2026] [:error] [pid 19818:tid 19832] [client 20.240.134.170:4057] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-cxs.php"] [unique_id "acTV38zaSnm3d1BeM5WBEwAAAMw"]
[Thu Mar 26 14:44:48.395601 2026] [:error] [pid 31778:tid 31817] [client 20.240.134.170:4076] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-scanner.php"] [unique_id "acTV4A3kybI2o-xasmC97wAAAdg"]
[Thu Mar 26 14:44:48.997966 2026] [:error] [pid 31670:tid 31689] [client 20.240.134.170:4048] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-scanner.php"] [unique_id "acTV4DXVthXxCnWjOTQQQgAAAVE"]
[Thu Mar 26 14:44:49.699437 2026] [:error] [pid 60829:tid 60837] [client 20.240.134.170:3980] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-scanner.php"] [unique_id "acTV4fTdjHKeZokybaSMBgAAAQY"]
[Thu Mar 26 14:44:50.286773 2026] [:error] [pid 31780:tid 31843] [client 20.240.134.170:4002] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-scanner.php"] [unique_id "acTV4pJDwZsy5O4ZXEhLNAAAAhY"]
[Thu Mar 26 14:44:50.893727 2026] [:error] [pid 19818:tid 19839] [client 20.240.134.170:4043] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/saorix1.php"] [unique_id "acTV4szaSnm3d1BeM5WBHQAAANM"]
[Thu Mar 26 14:44:51.483579 2026] [:error] [pid 31780:tid 31832] [client 20.240.134.170:4045] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/saorix1.php"] [unique_id "acTV45JDwZsy5O4ZXEhLNwAAAgs"]
[Thu Mar 26 14:44:52.070060 2026] [:error] [pid 31778:tid 31813] [client 20.240.134.170:3969] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/saorix1.php"] [unique_id "acTV5A3kybI2o-xasmC9_QAAAdQ"]
[Thu Mar 26 14:44:52.614901 2026] [:error] [pid 31717:tid 31737] [client 20.240.134.170:4088] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/saorix1.php"] [unique_id "acTV5L-SCF7YDISDX4-7fQAAAY8"]
[Thu Mar 26 14:44:53.146747 2026] [:error] [pid 60829:tid 60849] [client 20.240.134.170:4047] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acTV5fTdjHKeZokybaSMBwAAARI"]
[Thu Mar 26 14:44:53.834652 2026] [:error] [pid 19818:tid 19833] [client 20.240.134.170:3983] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acTV5czaSnm3d1BeM5WBJgAAAM0"]
[Thu Mar 26 14:44:54.382984 2026] [:error] [pid 19818:tid 19834] [client 20.240.134.170:4033] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acTV5szaSnm3d1BeM5WBLQAAAM4"]
[Thu Mar 26 14:44:54.977403 2026] [:error] [pid 19818:tid 19821] [client 20.240.134.170:3990] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acTV5szaSnm3d1BeM5WBMgAAAME"]
[Thu Mar 26 14:44:55.638137 2026] [:error] [pid 31670:tid 31672] [client 20.240.134.170:4038] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTV5zXVthXxCnWjOTQQUgAAAUA"]
[Thu Mar 26 14:44:56.281375 2026] [:error] [pid 31778:tid 31799] [client 20.240.134.170:4034] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTV6A3kybI2o-xasmC-BQAAAcY"]
[Thu Mar 26 14:44:56.834454 2026] [:error] [pid 19818:tid 19831] [client 20.240.134.170:3976] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTV6MzaSnm3d1BeM5WBPAAAAMs"]
[Thu Mar 26 14:44:57.448953 2026] [:error] [pid 19818:tid 19840] [client 20.240.134.170:4022] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/Jcrop.php"] [unique_id "acTV6czaSnm3d1BeM5WBQgAAANQ"]
[Thu Mar 26 14:44:58.013155 2026] [:error] [pid 31780:tid 31821] [client 20.240.134.170:3926] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nc4.php"] [unique_id "acTV6pJDwZsy5O4ZXEhLPQAAAgE"]
[Thu Mar 26 14:44:58.606687 2026] [:error] [pid 19711:tid 19755] [client 20.240.134.170:4085] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nc4.php"] [unique_id "acTV6mj3l1y81GYfluR3NgAAAEY"]
[Thu Mar 26 14:44:59.274935 2026] [:error] [pid 31670:tid 31688] [client 20.240.134.170:4049] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nc4.php"] [unique_id "acTV6zXVthXxCnWjOTQQWAAAAVA"]
[Thu Mar 26 14:44:59.819677 2026] [:error] [pid 19711:tid 19751] [client 20.240.134.170:4073] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nc4.php"] [unique_id "acTV62j3l1y81GYfluR3OQAAAEI"]
[Thu Mar 26 14:45:00.382753 2026] [:error] [pid 31780:tid 31843] [client 20.240.134.170:4067] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v3.php"] [unique_id "acTV7JJDwZsy5O4ZXEhLQgAAAhY"]
[Thu Mar 26 14:45:00.997146 2026] [:error] [pid 19818:tid 19839] [client 20.240.134.170:4060] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v3.php"] [unique_id "acTV7MzaSnm3d1BeM5WBWQAAANM"]
[Thu Mar 26 14:45:01.525339 2026] [:error] [pid 19818:tid 19821] [client 20.240.134.170:3920] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v3.php"] [unique_id "acTV7czaSnm3d1BeM5WBXAAAAME"]
[Thu Mar 26 14:45:02.070440 2026] [:error] [pid 31780:tid 31842] [client 20.240.134.170:4032] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v3.php"] [unique_id "acTV7pJDwZsy5O4ZXEhLRwAAAhU"]
[Thu Mar 26 14:45:02.645503 2026] [:error] [pid 31780:tid 31844] [client 20.240.134.170:4020] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "acTV7pJDwZsy5O4ZXEhLSgAAAhc"]
[Thu Mar 26 14:45:03.190998 2026] [:error] [pid 31717:tid 31722] [client 20.240.134.170:3971] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "acTV77-SCF7YDISDX4-7ggAAAYA"]
[Thu Mar 26 14:45:03.869230 2026] [:error] [pid 31670:tid 31688] [client 20.240.134.170:4028] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "acTV7zXVthXxCnWjOTQQfQAAAVA"]
[Thu Mar 26 14:45:04.429096 2026] [:error] [pid 19818:tid 19827] [client 20.240.134.170:4071] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "acTV8MzaSnm3d1BeM5WBZwAAAMc"]
[Thu Mar 26 14:45:05.015511 2026] [:error] [pid 31780:tid 31835] [client 20.240.134.170:4094] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xvs.php"] [unique_id "acTV8ZJDwZsy5O4ZXEhLUgAAAg4"]
[Thu Mar 26 14:45:05.556591 2026] [:error] [pid 31670:tid 31695] [client 20.240.134.170:4046] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xvs.php"] [unique_id "acTV8TXVthXxCnWjOTQQgQAAAVc"]
[Thu Mar 26 14:45:06.152896 2026] [:error] [pid 31778:tid 31796] [client 20.240.134.170:3978] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xvs.php"] [unique_id "acTV8g3kybI2o-xasmC-EwAAAcM"]
[Thu Mar 26 14:45:06.752114 2026] [:error] [pid 19818:tid 19840] [client 20.240.134.170:4072] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xvs.php"] [unique_id "acTV8szaSnm3d1BeM5WBbAAAANQ"]
[Thu Mar 26 14:45:07.422036 2026] [:error] [pid 31717:tid 31730] [client 20.240.134.170:4040] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sid3.php"] [unique_id "acTV87-SCF7YDISDX4-7hAAAAYg"]
[Thu Mar 26 14:45:07.959035 2026] [:error] [pid 19710:tid 19739] [client 20.240.134.170:3991] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sid3.php"] [unique_id "acTV8wVEWP8Ar68Njk7fZwAAABE"]
[Thu Mar 26 14:45:08.610386 2026] [:error] [pid 60829:tid 60846] [client 20.240.134.170:4087] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sid3.php"] [unique_id "acTV9PTdjHKeZokybaSMFAAAAQ8"]
[Thu Mar 26 14:45:09.209383 2026] [:error] [pid 31717:tid 31724] [client 20.240.134.170:3987] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sid3.php"] [unique_id "acTV9b-SCF7YDISDX4-7hwAAAYI"]
[Thu Mar 26 14:45:09.819743 2026] [:error] [pid 19818:tid 19826] [client 20.240.134.170:3908] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs.php"] [unique_id "acTV9czaSnm3d1BeM5WBeQAAAMY"]
[Thu Mar 26 14:45:10.384180 2026] [:error] [pid 31778:tid 31814] [client 20.240.134.170:4079] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs.php"] [unique_id "acTV9g3kybI2o-xasmC-GwAAAdU"]
[Thu Mar 26 14:45:10.956388 2026] [:error] [pid 31670:tid 31686] [client 20.240.134.170:3986] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs.php"] [unique_id "acTV9jXVthXxCnWjOTQQigAAAU4"]
[Thu Mar 26 14:45:11.608620 2026] [:error] [pid 19818:tid 19822] [client 20.240.134.170:4004] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs.php"] [unique_id "acTV98zaSnm3d1BeM5WBegAAAMI"]
[Thu Mar 26 14:45:12.145715 2026] [:error] [pid 31717:tid 31736] [client 20.240.134.170:4091] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acTV-L-SCF7YDISDX4-7iQAAAY4"]
[Thu Mar 26 14:45:12.760114 2026] [:error] [pid 60829:tid 60848] [client 20.240.134.170:3992] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acTV-PTdjHKeZokybaSMGwAAARE"]
[Thu Mar 26 14:45:13.331990 2026] [:error] [pid 31780:tid 31835] [client 20.240.134.170:3913] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acTV-ZJDwZsy5O4ZXEhLWAAAAg4"]
[Thu Mar 26 14:45:13.859329 2026] [:error] [pid 31780:tid 31842] [client 20.240.134.170:3921] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acTV-ZJDwZsy5O4ZXEhLXQAAAhU"]
[Thu Mar 26 14:45:14.495634 2026] [:error] [pid 31670:tid 31687] [client 20.240.134.170:3989] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acTV-jXVthXxCnWjOTQQkgAAAU8"]
[Thu Mar 26 14:45:15.037297 2026] [:error] [pid 31717:tid 31745] [client 20.240.134.170:4017] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acTV-7-SCF7YDISDX4-7igAAAZc"]
[Thu Mar 26 14:45:15.568717 2026] [:error] [pid 19712:tid 19776] [client 20.240.134.170:4092] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acTV-9WhKhRNqm23vFMFWwAAAIA"]
[Thu Mar 26 14:45:16.386689 2026] [:error] [pid 31778:tid 31811] [client 20.240.134.170:3997] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acTV_A3kybI2o-xasmC-LwAAAdI"]
[Thu Mar 26 14:45:16.925555 2026] [:error] [pid 31780:tid 31826] [client 20.240.134.170:4083] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws84.php"] [unique_id "acTV_JJDwZsy5O4ZXEhLZQAAAgY"]
[Thu Mar 26 14:45:17.478494 2026] [:error] [pid 31717:tid 31726] [client 20.240.134.170:3985] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws84.php"] [unique_id "acTV_b-SCF7YDISDX4-7jwAAAYQ"]
[Thu Mar 26 14:45:18.030542 2026] [:error] [pid 19818:tid 19831] [client 20.240.134.170:4015] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws84.php"] [unique_id "acTV_szaSnm3d1BeM5WBhgAAAMs"]
[Thu Mar 26 14:45:18.606440 2026] [:error] [pid 19710:tid 19736] [client 20.240.134.170:3912] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws84.php"] [unique_id "acTV_gVEWP8Ar68Njk7fbQAAAA4"]
[Thu Mar 26 14:45:19.209446 2026] [:error] [pid 31670:tid 31694] [client 20.240.134.170:4070] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/feokc.php"] [unique_id "acTV_zXVthXxCnWjOTQQoAAAAVY"]
[Thu Mar 26 14:45:19.753901 2026] [:error] [pid 31670:tid 31674] [client 20.240.134.170:4093] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/feokc.php"] [unique_id "acTV_zXVthXxCnWjOTQQpgAAAUI"]
[Thu Mar 26 14:45:20.401108 2026] [:error] [pid 31670:tid 31685] [client 20.240.134.170:4005] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/feokc.php"] [unique_id "acTWADXVthXxCnWjOTQQrgAAAU0"]
[Thu Mar 26 14:45:21.377746 2026] [:error] [pid 31670:tid 31677] [client 20.240.134.170:4056] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/feokc.php"] [unique_id "acTWATXVthXxCnWjOTQQswAAAUU"]
[Thu Mar 26 14:45:21.935719 2026] [:error] [pid 31780:tid 31836] [client 20.240.134.170:4080] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wgift1.php"] [unique_id "acTWAZJDwZsy5O4ZXEhLcgAAAg8"]
[Thu Mar 26 14:45:22.591827 2026] [:error] [pid 31670:tid 31676] [client 20.240.134.170:4024] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wgift1.php"] [unique_id "acTWAjXVthXxCnWjOTQQvAAAAUQ"]
[Thu Mar 26 14:45:23.206184 2026] [:error] [pid 31670:tid 31683] [client 20.240.134.170:3988] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wgift1.php"] [unique_id "acTWAzXVthXxCnWjOTQQwgAAAUs"]
[Thu Mar 26 14:45:23.754887 2026] [:error] [pid 60829:tid 60837] [client 20.240.134.170:4077] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wgift1.php"] [unique_id "acTWA_TdjHKeZokybaSMHgAAAQY"]
[Thu Mar 26 14:45:24.307756 2026] [:error] [pid 31670:tid 31673] [client 20.240.134.170:3970] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acTWBDXVthXxCnWjOTQQzAAAAUE"]
[Thu Mar 26 14:45:24.924014 2026] [:error] [pid 31670:tid 31676] [client 20.240.134.170:3943] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acTWBDXVthXxCnWjOTQQ0QAAAUQ"]
[Thu Mar 26 14:45:25.456691 2026] [:error] [pid 31670:tid 31674] [client 20.240.134.170:3973] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acTWBTXVthXxCnWjOTQQ0wAAAUI"]
[Thu Mar 26 14:45:25.983255 2026] [:error] [pid 31780:tid 31836] [client 20.240.134.170:4009] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/admin.php"] [unique_id "acTWBZJDwZsy5O4ZXEhLfAAAAg8"]
[Thu Mar 26 14:45:26.606097 2026] [:error] [pid 31670:tid 31673] [client 20.240.134.170:4052] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lp6.php"] [unique_id "acTWBjXVthXxCnWjOTQQ2AAAAUE"]
[Thu Mar 26 14:45:27.135456 2026] [:error] [pid 19818:tid 19829] [client 20.240.134.170:3942] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lp6.php"] [unique_id "acTWB8zaSnm3d1BeM5WBiwAAAMk"]
[Thu Mar 26 14:45:27.738890 2026] [:error] [pid 19818:tid 19831] [client 20.240.134.170:4074] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lp6.php"] [unique_id "acTWB8zaSnm3d1BeM5WBkAAAAMs"]
[Thu Mar 26 14:45:28.325692 2026] [:error] [pid 31670:tid 31696] [client 20.240.134.170:3925] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lp6.php"] [unique_id "acTWCDXVthXxCnWjOTQQ3QAAAVg"]
[Thu Mar 26 14:45:28.916575 2026] [:error] [pid 60829:tid 60843] [client 20.240.134.170:4064] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/admin.php"] [unique_id "acTWCPTdjHKeZokybaSMIgAAAQw"]
[Thu Mar 26 14:45:29.470402 2026] [:error] [pid 31670:tid 31674] [client 20.240.134.170:4061] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/admin.php"] [unique_id "acTWCTXVthXxCnWjOTQQ4wAAAUI"]
[Thu Mar 26 14:45:30.076324 2026] [:error] [pid 19818:tid 19840] [client 20.240.134.170:3940] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/admin.php"] [unique_id "acTWCszaSnm3d1BeM5WBlAAAANQ"]
[Thu Mar 26 14:45:30.601886 2026] [:error] [pid 60829:tid 60831] [client 20.240.134.170:4042] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/admin.php"] [unique_id "acTWCvTdjHKeZokybaSMJAAAAQA"]
[Thu Mar 26 14:45:31.230085 2026] [:error] [pid 31780:tid 31824] [client 20.240.134.170:3981] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/24.php"] [unique_id "acTWC5JDwZsy5O4ZXEhLhgAAAgQ"]
[Thu Mar 26 14:45:31.830278 2026] [:error] [pid 31780:tid 31843] [client 20.240.134.170:3906] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/24.php"] [unique_id "acTWC5JDwZsy5O4ZXEhLiQAAAhY"]
[Thu Mar 26 14:45:32.388881 2026] [:error] [pid 31670:tid 31674] [client 20.240.134.170:4053] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/24.php"] [unique_id "acTWDDXVthXxCnWjOTQQ7AAAAUI"]
[Thu Mar 26 14:45:32.918841 2026] [:error] [pid 19710:tid 19743] [client 20.240.134.170:3979] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/24.php"] [unique_id "acTWDAVEWP8Ar68Njk7fegAAABU"]
[Thu Mar 26 14:45:33.501315 2026] [:error] [pid 31670:tid 31673] [client 20.240.134.170:4095] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acTWDTXVthXxCnWjOTQQ8gAAAUE"]
[Thu Mar 26 14:45:34.287898 2026] [:error] [pid 31670:tid 31686] [client 20.240.134.170:4001] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acTWDjXVthXxCnWjOTQQ9wAAAU4"]
[Thu Mar 26 14:45:34.892486 2026] [:error] [pid 19818:tid 19834] [client 20.240.134.170:4086] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acTWDszaSnm3d1BeM5WBlgAAAM4"]
[Thu Mar 26 14:45:35.434891 2026] [:error] [pid 31780:tid 31843] [client 20.240.134.170:3953] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acTWD5JDwZsy5O4ZXEhLlgAAAhY"]
[Thu Mar 26 14:45:35.966736 2026] [:error] [pid 31780:tid 31839] [client 20.240.134.170:4036] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acTWD5JDwZsy5O4ZXEhLmQAAAhI"]
[Thu Mar 26 14:45:36.586024 2026] [:error] [pid 31780:tid 31837] [client 20.240.134.170:3938] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acTWEJJDwZsy5O4ZXEhLnAAAAhA"]
[Thu Mar 26 14:45:37.118087 2026] [:error] [pid 19711:tid 19755] [client 20.240.134.170:3930] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acTWEWj3l1y81GYfluR3RAAAAEY"]
[Thu Mar 26 14:45:37.652308 2026] [:error] [pid 31780:tid 31836] [client 20.240.134.170:4031] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acTWEZJDwZsy5O4ZXEhLogAAAg8"]
[Thu Mar 26 14:45:38.176760 2026] [:error] [pid 19818:tid 19821] [client 20.240.134.170:4014] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aifa.php"] [unique_id "acTWEszaSnm3d1BeM5WBmQAAAME"]
[Thu Mar 26 14:45:38.826637 2026] [:error] [pid 19818:tid 19824] [client 20.240.134.170:3939] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aifa.php"] [unique_id "acTWEszaSnm3d1BeM5WBoAAAAMQ"]
[Thu Mar 26 14:45:39.411927 2026] [:error] [pid 31670:tid 31687] [client 20.240.134.170:4003] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aifa.php"] [unique_id "acTWEzXVthXxCnWjOTQRAQAAAU8"]
[Thu Mar 26 14:45:39.986345 2026] [:error] [pid 31670:tid 31692] [client 20.240.134.170:4044] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aifa.php"] [unique_id "acTWEzXVthXxCnWjOTQRBAAAAVQ"]
[Thu Mar 26 14:45:43.118996 2026] [:error] [pid 31780:tid 31837] [client 20.240.134.170:3996] [client 20.240.134.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/app.php"] [unique_id "acTWF5JDwZsy5O4ZXEhLsAAAAhA"]
[Thu Mar 26 14:45:57.462893 2026] [:error] [pid 31778:tid 31812] [client 20.240.134.170:3968] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acTWJQ3kybI2o-xasmC-ZAAAAdM"]
[Thu Mar 26 14:45:58.071284 2026] [:error] [pid 19818:tid 19843] [client 20.240.134.170:4041] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acTWJszaSnm3d1BeM5WB3AAAANc"]
[Thu Mar 26 14:45:58.601881 2026] [:error] [pid 19711:tid 19772] [client 20.240.134.170:3916] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acTWJmj3l1y81GYfluR3TgAAAFc"]
[Thu Mar 26 14:45:59.124799 2026] [:error] [pid 19818:tid 19840] [client 20.240.134.170:4026] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acTWJ8zaSnm3d1BeM5WB3wAAANQ"]
[Thu Mar 26 14:45:59.742873 2026] [:error] [pid 31780:tid 31820] [client 20.240.134.170:4082] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acTWJ5JDwZsy5O4ZXEhL3gAAAgA"]
[Thu Mar 26 14:46:00.310053 2026] [:error] [pid 31670:tid 31678] [client 20.240.134.170:4039] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acTWKDXVthXxCnWjOTQREwAAAUY"]
[Thu Mar 26 14:46:00.923721 2026] [:error] [pid 31780:tid 31823] [client 20.240.134.170:3873] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acTWKJJDwZsy5O4ZXEhL4AAAAgM"]
[Thu Mar 26 14:46:03.186085 2026] [:error] [pid 19712:tid 19783] [client 20.240.134.170:3975] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acTWK9WhKhRNqm23vFMFcgAAAIc"]
[Thu Mar 26 14:46:07.373627 2026] [:error] [pid 19818:tid 19843] [client 20.240.134.170:3977] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t00l.php"] [unique_id "acTWL8zaSnm3d1BeM5WB9gAAANc"]
[Thu Mar 26 14:46:08.127348 2026] [:error] [pid 19711:tid 19772] [client 20.240.134.170:3955] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t00l.php"] [unique_id "acTWMGj3l1y81GYfluR3WgAAAFc"]
[Thu Mar 26 14:46:08.667299 2026] [:error] [pid 31780:tid 31830] [client 20.240.134.170:4050] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t00l.php"] [unique_id "acTWMJJDwZsy5O4ZXEhL8gAAAgk"]
[Thu Mar 26 14:46:09.330759 2026] [:error] [pid 31780:tid 31841] [client 20.240.134.170:4021] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t00l.php"] [unique_id "acTWMZJDwZsy5O4ZXEhL8wAAAhQ"]
[Thu Mar 26 14:46:09.909612 2026] [:error] [pid 19710:tid 19729] [client 20.240.134.170:3933] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acTWMQVEWP8Ar68Njk7fnAAAAAc"]
[Thu Mar 26 14:46:10.444727 2026] [:error] [pid 19712:tid 19788] [client 20.240.134.170:4025] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acTWMtWhKhRNqm23vFMFegAAAIw"]
[Thu Mar 26 14:46:10.970178 2026] [:error] [pid 31780:tid 31836] [client 20.240.134.170:3998] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acTWMpJDwZsy5O4ZXEhL9AAAAg8"]
[Thu Mar 26 14:46:11.495331 2026] [:error] [pid 31778:tid 31806] [client 20.240.134.170:3911] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acTWMw3kybI2o-xasmC-dQAAAc0"]
[Thu Mar 26 14:46:12.189566 2026] [:error] [pid 31778:tid 31798] [client 20.240.134.170:4000] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wps.php"] [unique_id "acTWNA3kybI2o-xasmC-eAAAAcU"]
[Thu Mar 26 14:46:12.719369 2026] [:error] [pid 19712:tid 19800] [client 20.240.134.170:3922] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wps.php"] [unique_id "acTWNNWhKhRNqm23vFMFgAAAAJg"]
[Thu Mar 26 14:46:13.289522 2026] [:error] [pid 31717:tid 31728] [client 20.240.134.170:4010] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wps.php"] [unique_id "acTWNb-SCF7YDISDX4-7sQAAAYY"]
[Thu Mar 26 14:46:13.848147 2026] [:error] [pid 31717:tid 31741] [client 20.240.134.170:3909] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wps.php"] [unique_id "acTWNb-SCF7YDISDX4-7tAAAAZM"]
[Thu Mar 26 14:46:14.383582 2026] [:error] [pid 31717:tid 31732] [client 20.240.134.170:4030] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/web.php"] [unique_id "acTWNr-SCF7YDISDX4-7uAAAAYo"]
[Thu Mar 26 14:46:14.927566 2026] [:error] [pid 31717:tid 31726] [client 20.240.134.170:4063] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/web.php"] [unique_id "acTWNr-SCF7YDISDX4-7ugAAAYQ"]
[Thu Mar 26 14:46:15.562530 2026] [:error] [pid 31778:tid 31809] [client 20.240.134.170:3915] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/web.php"] [unique_id "acTWNw3kybI2o-xasmC-fwAAAdA"]
[Thu Mar 26 14:46:16.210929 2026] [:error] [pid 19710:tid 19741] [client 20.240.134.170:4090] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/web.php"] [unique_id "acTWOAVEWP8Ar68Njk7fpQAAABM"]
[Thu Mar 26 14:46:16.806301 2026] [:error] [pid 19710:tid 19744] [client 20.240.134.170:3963] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acTWOAVEWP8Ar68Njk7fpwAAABY"]
[Thu Mar 26 14:46:17.403095 2026] [:error] [pid 19818:tid 19835] [client 20.240.134.170:4007] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acTWOczaSnm3d1BeM5WCBgAAAM8"]
[Thu Mar 26 14:46:18.063575 2026] [:error] [pid 19818:tid 19821] [client 20.240.134.170:3844] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acTWOszaSnm3d1BeM5WCDQAAAME"]
[Thu Mar 26 14:46:18.602931 2026] [:error] [pid 19818:tid 19832] [client 20.240.134.170:3961] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "acTWOszaSnm3d1BeM5WCEwAAAMw"]
[Thu Mar 26 14:46:19.145373 2026] [:error] [pid 31670:tid 31681] [client 20.240.134.170:3933] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asd.php"] [unique_id "acTWOzXVthXxCnWjOTQRKwAAAUk"]
[Thu Mar 26 14:46:19.741113 2026] [:error] [pid 31670:tid 31679] [client 20.240.134.170:4089] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asd.php"] [unique_id "acTWOzXVthXxCnWjOTQRMgAAAUc"]
[Thu Mar 26 14:46:20.267636 2026] [:error] [pid 19712:tid 19794] [client 20.240.134.170:3934] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asd.php"] [unique_id "acTWPNWhKhRNqm23vFMFigAAAJI"]
[Thu Mar 26 14:46:20.815637 2026] [:error] [pid 19818:tid 19825] [client 20.240.134.170:3966] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asd.php"] [unique_id "acTWPMzaSnm3d1BeM5WCHgAAAMU"]
[Thu Mar 26 14:46:21.473916 2026] [:error] [pid 19710:tid 19742] [client 20.240.134.170:4008] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/awh.php"] [unique_id "acTWPQVEWP8Ar68Njk7fqgAAABQ"]
[Thu Mar 26 14:46:22.011595 2026] [:error] [pid 19818:tid 19822] [client 20.240.134.170:3843] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/awh.php"] [unique_id "acTWPszaSnm3d1BeM5WCKAAAAMI"]
[Thu Mar 26 14:46:22.607987 2026] [:error] [pid 19818:tid 19833] [client 20.240.134.170:4023] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/awh.php"] [unique_id "acTWPszaSnm3d1BeM5WCLwAAAM0"]
[Thu Mar 26 14:46:23.225029 2026] [:error] [pid 19818:tid 19820] [client 20.240.134.170:3928] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/awh.php"] [unique_id "acTWP8zaSnm3d1BeM5WCNgAAAMA"]
[Thu Mar 26 14:46:23.804326 2026] [:error] [pid 60829:tid 60848] [client 20.240.134.170:3871] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gelio1.php"] [unique_id "acTWP_TdjHKeZokybaSMSgAAARE"]
[Thu Mar 26 14:46:24.377610 2026] [:error] [pid 19818:tid 19829] [client 20.240.134.170:3845] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gelio1.php"] [unique_id "acTWQMzaSnm3d1BeM5WCOQAAAMk"]
[Thu Mar 26 14:46:24.931831 2026] [:error] [pid 31780:tid 31830] [client 20.240.134.170:3849] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gelio1.php"] [unique_id "acTWQJJDwZsy5O4ZXEhL_AAAAgk"]
[Thu Mar 26 14:46:25.510941 2026] [:error] [pid 31670:tid 31680] [client 20.240.134.170:3999] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gelio1.php"] [unique_id "acTWQTXVthXxCnWjOTQRUQAAAUg"]
[Thu Mar 26 14:46:26.089630 2026] [:error] [pid 31670:tid 31692] [client 20.240.134.170:3892] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xper1.php"] [unique_id "acTWQjXVthXxCnWjOTQRVwAAAVQ"]
[Thu Mar 26 14:46:26.736624 2026] [:error] [pid 19818:tid 19843] [client 20.240.134.170:3919] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xper1.php"] [unique_id "acTWQszaSnm3d1BeM5WCQgAAANc"]
[Thu Mar 26 14:46:27.287046 2026] [:error] [pid 31717:tid 31734] [client 20.240.134.170:3948] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xper1.php"] [unique_id "acTWQ7-SCF7YDISDX4-7xgAAAYw"]
[Thu Mar 26 14:46:27.875752 2026] [:error] [pid 31778:tid 31814] [client 20.240.134.170:3937] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xper1.php"] [unique_id "acTWQw3kybI2o-xasmC-hwAAAdU"]
[Thu Mar 26 14:46:28.455246 2026] [:error] [pid 31670:tid 31689] [client 20.240.134.170:3784] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bo.php"] [unique_id "acTWRDXVthXxCnWjOTQRYAAAAVE"]
[Thu Mar 26 14:46:29.118013 2026] [:error] [pid 31778:tid 31796] [client 20.240.134.170:4051] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bo.php"] [unique_id "acTWRQ3kybI2o-xasmC-igAAAcM"]
[Thu Mar 26 14:46:29.740178 2026] [:error] [pid 19818:tid 19821] [client 20.240.134.170:3954] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bo.php"] [unique_id "acTWRczaSnm3d1BeM5WCTQAAAME"]
[Thu Mar 26 14:46:30.293390 2026] [:error] [pid 19818:tid 19823] [client 20.240.134.170:3941] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bo.php"] [unique_id "acTWRszaSnm3d1BeM5WCUwAAAMM"]
[Thu Mar 26 14:46:30.823550 2026] [:error] [pid 19818:tid 19831] [client 20.240.134.170:3914] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class.php"] [unique_id "acTWRszaSnm3d1BeM5WCXQAAAMs"]
[Thu Mar 26 14:46:31.353516 2026] [:error] [pid 31780:tid 31824] [client 20.240.134.170:3854] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class.php"] [unique_id "acTWR5JDwZsy5O4ZXEhMCQAAAgQ"]
[Thu Mar 26 14:46:31.890736 2026] [:error] [pid 31780:tid 31845] [client 20.240.134.170:3957] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class.php"] [unique_id "acTWR5JDwZsy5O4ZXEhMCwAAAhg"]
[Thu Mar 26 14:46:32.415437 2026] [:error] [pid 19818:tid 19825] [client 20.240.134.170:3846] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class.php"] [unique_id "acTWSMzaSnm3d1BeM5WCZQAAAMU"]
[Thu Mar 26 14:46:32.951272 2026] [:error] [pid 31780:tid 31822] [client 20.240.134.170:3959] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/privacy.php"] [unique_id "acTWSJJDwZsy5O4ZXEhMEAAAAgI"]
[Thu Mar 26 14:46:33.477097 2026] [:error] [pid 19818:tid 19843] [client 20.240.134.170:4078] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/privacy.php"] [unique_id "acTWSczaSnm3d1BeM5WCbgAAANc"]
[Thu Mar 26 14:46:34.290345 2026] [:error] [pid 31778:tid 31797] [client 20.240.134.170:3974] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/privacy.php"] [unique_id "acTWSg3kybI2o-xasmC-lQAAAcQ"]
[Thu Mar 26 14:46:34.922593 2026] [:error] [pid 31670:tid 31684] [client 20.240.134.170:3944] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/privacy.php"] [unique_id "acTWSjXVthXxCnWjOTQRdQAAAUw"]
[Thu Mar 26 14:46:35.571769 2026] [:error] [pid 31778:tid 31795] [client 20.240.134.170:3853] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ng.php"] [unique_id "acTWSw3kybI2o-xasmC-nwAAAcI"]
[Thu Mar 26 14:46:36.143618 2026] [:error] [pid 31670:tid 31688] [client 20.240.134.170:3964] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ng.php"] [unique_id "acTWTDXVthXxCnWjOTQReQAAAVA"]
[Thu Mar 26 14:46:36.897799 2026] [:error] [pid 19818:tid 19840] [client 20.240.134.170:3936] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ng.php"] [unique_id "acTWTMzaSnm3d1BeM5WCegAAANQ"]
[Thu Mar 26 14:46:37.536810 2026] [:error] [pid 19818:tid 19834] [client 20.240.134.170:4013] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ng.php"] [unique_id "acTWTczaSnm3d1BeM5WCfQAAAM4"]
[Thu Mar 26 14:46:38.161198 2026] [:error] [pid 19818:tid 19824] [client 20.240.134.170:3917] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gm.php"] [unique_id "acTWTszaSnm3d1BeM5WCgwAAAMQ"]
[Thu Mar 26 14:46:38.742995 2026] [:error] [pid 31717:tid 31735] [client 20.240.134.170:3960] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gm.php"] [unique_id "acTWTr-SCF7YDISDX4-7yQAAAY0"]
[Thu Mar 26 14:46:39.278202 2026] [:error] [pid 60829:tid 60835] [client 20.240.134.170:4018] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gm.php"] [unique_id "acTWT_TdjHKeZokybaSMUgAAAQQ"]
[Thu Mar 26 14:46:39.877783 2026] [:error] [pid 31717:tid 31726] [client 20.240.134.170:3967] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gm.php"] [unique_id "acTWT7-SCF7YDISDX4-7zAAAAYQ"]
[Thu Mar 26 14:46:40.489459 2026] [:error] [pid 19818:tid 19828] [client 20.240.134.170:3927] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acTWUMzaSnm3d1BeM5WCkQAAAMg"]
[Thu Mar 26 14:46:41.240433 2026] [:error] [pid 19818:tid 19833] [client 20.240.134.170:3847] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acTWUczaSnm3d1BeM5WClQAAAM0"]
[Thu Mar 26 14:46:41.981938 2026] [:error] [pid 60829:tid 60831] [client 20.240.134.170:3842] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acTWUfTdjHKeZokybaSMVQAAAQA"]
[Thu Mar 26 14:46:42.548910 2026] [:error] [pid 31670:tid 31691] [client 20.240.134.170:3956] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acTWUjXVthXxCnWjOTQRjAAAAVM"]
[Thu Mar 26 14:46:43.194331 2026] [:error] [pid 31670:tid 31674] [client 20.240.134.170:3848] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/x1.php"] [unique_id "acTWUzXVthXxCnWjOTQRkgAAAUI"]
[Thu Mar 26 14:46:43.893828 2026] [:error] [pid 31778:tid 31807] [client 20.240.134.170:3950] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/x1.php"] [unique_id "acTWUw3kybI2o-xasmC-rgAAAc4"]
[Thu Mar 26 14:46:44.575397 2026] [:error] [pid 31670:tid 31694] [client 20.240.134.170:3946] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/x1.php"] [unique_id "acTWVDXVthXxCnWjOTQRnQAAAVY"]
[Thu Mar 26 14:46:45.211565 2026] [:error] [pid 19818:tid 19829] [client 20.240.134.170:3962] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/x1.php"] [unique_id "acTWVczaSnm3d1BeM5WCngAAAMk"]
[Thu Mar 26 14:46:45.758392 2026] [:error] [pid 19818:tid 19830] [client 20.240.134.170:4011] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acTWVczaSnm3d1BeM5WCoQAAAMo"]
[Thu Mar 26 14:46:46.464707 2026] [:error] [pid 31778:tid 31812] [client 20.240.134.170:3856] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acTWVg3kybI2o-xasmC-twAAAdM"]
[Thu Mar 26 14:46:47.076307 2026] [:error] [pid 60829:tid 60844] [client 20.240.134.170:4027] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acTWV_TdjHKeZokybaSMWgAAAQ0"]
[Thu Mar 26 14:46:47.641744 2026] [:error] [pid 31780:tid 31823] [client 20.240.134.170:3883] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acTWV5JDwZsy5O4ZXEhMJAAAAgM"]
[Thu Mar 26 14:46:48.272486 2026] [:error] [pid 60829:tid 60855] [client 20.240.134.170:3907] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/byypas.php"] [unique_id "acTWWPTdjHKeZokybaSMYAAAARg"]
[Thu Mar 26 14:46:48.888720 2026] [:error] [pid 31670:tid 31680] [client 20.240.134.170:4019] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/byypas.php"] [unique_id "acTWWDXVthXxCnWjOTQRqAAAAUg"]
[Thu Mar 26 14:46:49.462063 2026] [:error] [pid 31670:tid 31672] [client 20.240.134.170:3945] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/byypas.php"] [unique_id "acTWWTXVthXxCnWjOTQRrQAAAUA"]
[Thu Mar 26 14:46:49.994443 2026] [:error] [pid 31780:tid 31822] [client 20.240.134.170:3869] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/byypas.php"] [unique_id "acTWWZJDwZsy5O4ZXEhMJwAAAgI"]
[Thu Mar 26 14:46:50.695289 2026] [:error] [pid 31717:tid 31724] [client 20.240.134.170:3947] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/domains.php"] [unique_id "acTWWr-SCF7YDISDX4-71QAAAYI"]
[Thu Mar 26 14:46:51.226742 2026] [:error] [pid 19712:tid 19798] [client 20.240.134.170:3881] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/domains.php"] [unique_id "acTWW9WhKhRNqm23vFMFkgAAAJY"]
[Thu Mar 26 14:46:51.980049 2026] [:error] [pid 31717:tid 31741] [client 20.240.134.170:3952] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/domains.php"] [unique_id "acTWW7-SCF7YDISDX4-72AAAAZM"]
[Thu Mar 26 14:46:52.597937 2026] [:error] [pid 31778:tid 31801] [client 20.240.134.170:3866] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/domains.php"] [unique_id "acTWXA3kybI2o-xasmC-xgAAAcg"]
[Thu Mar 26 14:46:53.397085 2026] [:error] [pid 19711:tid 19768] [client 20.240.134.170:3901] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/az.php"] [unique_id "acTWXWj3l1y81GYfluR3awAAAFM"]
[Thu Mar 26 14:46:54.181144 2026] [:error] [pid 19711:tid 19757] [client 20.240.134.170:4035] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/az.php"] [unique_id "acTWXmj3l1y81GYfluR3bAAAAEg"]
[Thu Mar 26 14:46:54.985273 2026] [:error] [pid 60829:tid 60850] [client 20.240.134.170:3923] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/az.php"] [unique_id "acTWXvTdjHKeZokybaSMcQAAARM"]
[Thu Mar 26 14:46:55.827559 2026] [:error] [pid 31670:tid 31694] [client 20.240.134.170:4037] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/az.php"] [unique_id "acTWXzXVthXxCnWjOTQRtQAAAVY"]
[Thu Mar 26 14:47:18.481923 2026] [:error] [pid 19818:tid 19838] [client 20.240.134.170:3863] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acTWdszaSnm3d1BeM5WDDwAAANI"]
[Thu Mar 26 14:47:19.019181 2026] [:error] [pid 19818:tid 19828] [client 20.240.134.170:4012] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acTWd8zaSnm3d1BeM5WDEgAAAMg"]
[Thu Mar 26 14:47:19.565148 2026] [:error] [pid 31780:tid 31824] [client 20.240.134.170:3714] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acTWd5JDwZsy5O4ZXEhMVQAAAgQ"]
[Thu Mar 26 14:47:20.095634 2026] [:error] [pid 31778:tid 31803] [client 20.240.134.170:4068] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acTWeA3kybI2o-xasmC-9gAAAco"]
[Thu Mar 26 14:47:20.666931 2026] [:error] [pid 31717:tid 31744] [client 20.240.134.170:3867] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filesss.php"] [unique_id "acTWeL-SCF7YDISDX4-7_gAAAZY"]
[Thu Mar 26 14:47:21.233315 2026] [:error] [pid 31778:tid 31804] [client 20.240.134.170:4016] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filesss.php"] [unique_id "acTWeQ3kybI2o-xasmC--QAAAcs"]
[Thu Mar 26 14:47:21.808337 2026] [:error] [pid 19818:tid 19830] [client 20.240.134.170:3840] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filesss.php"] [unique_id "acTWeczaSnm3d1BeM5WDHAAAAMo"]
[Thu Mar 26 14:47:22.446366 2026] [:error] [pid 60829:tid 60836] [client 20.240.134.170:3932] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filesss.php"] [unique_id "acTWevTdjHKeZokybaSMrQAAAQU"]
[Thu Mar 26 14:47:22.979171 2026] [:error] [pid 19818:tid 19821] [client 20.240.134.170:3865] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-aaa.php"] [unique_id "acTWeszaSnm3d1BeM5WDIwAAAME"]
[Thu Mar 26 14:47:23.582026 2026] [:error] [pid 31670:tid 31695] [client 20.240.134.170:3931] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-aaa.php"] [unique_id "acTWezXVthXxCnWjOTQSFgAAAVc"]
[Thu Mar 26 14:47:24.299842 2026] [:error] [pid 31780:tid 31831] [client 20.240.134.170:3850] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-aaa.php"] [unique_id "acTWfJJDwZsy5O4ZXEhMZAAAAgo"]
[Thu Mar 26 14:47:24.855734 2026] [:error] [pid 60829:tid 60849] [client 20.240.134.170:4058] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-aaa.php"] [unique_id "acTWfPTdjHKeZokybaSMsgAAARI"]
[Thu Mar 26 14:47:25.387736 2026] [:error] [pid 31670:tid 31675] [client 20.240.134.170:4065] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-freya.php"] [unique_id "acTWfTXVthXxCnWjOTQSHQAAAUM"]
[Thu Mar 26 14:47:25.918892 2026] [:error] [pid 31670:tid 31695] [client 20.240.134.170:3889] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-freya.php"] [unique_id "acTWfTXVthXxCnWjOTQSIwAAAVc"]
[Thu Mar 26 14:47:26.450443 2026] [:error] [pid 31670:tid 31696] [client 20.240.134.170:3875] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-freya.php"] [unique_id "acTWfjXVthXxCnWjOTQSKwAAAVg"]
[Thu Mar 26 14:47:27.030942 2026] [:error] [pid 31670:tid 31673] [client 20.240.134.170:3929] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-freya.php"] [unique_id "acTWfzXVthXxCnWjOTQSLwAAAUE"]
[Thu Mar 26 14:47:27.642441 2026] [:error] [pid 31780:tid 31837] [client 20.240.134.170:3958] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/X7x.php"] [unique_id "acTWf5JDwZsy5O4ZXEhMbgAAAhA"]
[Thu Mar 26 14:47:28.209997 2026] [:error] [pid 19818:tid 19843] [client 20.240.134.170:3905] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/X7x.php"] [unique_id "acTWgMzaSnm3d1BeM5WDLAAAANc"]
[Thu Mar 26 14:47:28.826463 2026] [:error] [pid 31670:tid 31684] [client 20.240.134.170:3796] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/X7x.php"] [unique_id "acTWgDXVthXxCnWjOTQSQAAAAUw"]
[Thu Mar 26 14:47:29.421349 2026] [:error] [pid 31780:tid 31825] [client 20.240.134.170:3884] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/X7x.php"] [unique_id "acTWgZJDwZsy5O4ZXEhMdAAAAgU"]
[Thu Mar 26 14:47:30.002438 2026] [:error] [pid 60829:tid 60854] [client 20.240.134.170:3879] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/opts.php"] [unique_id "acTWgvTdjHKeZokybaSMvgAAARc"]
[Thu Mar 26 14:47:30.572982 2026] [:error] [pid 19818:tid 19827] [client 20.240.134.170:3779] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/opts.php"] [unique_id "acTWgszaSnm3d1BeM5WDNgAAAMc"]
[Thu Mar 26 14:47:31.106007 2026] [:error] [pid 31717:tid 31727] [client 20.240.134.170:4006] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/opts.php"] [unique_id "acTWg7-SCF7YDISDX4-8DQAAAYU"]
[Thu Mar 26 14:47:31.682599 2026] [:error] [pid 31670:tid 31672] [client 20.240.134.170:3882] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/opts.php"] [unique_id "acTWgzXVthXxCnWjOTQSRQAAAUA"]
[Thu Mar 26 14:47:32.287825 2026] [:error] [pid 19711:tid 19757] [client 20.240.134.170:3993] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filer.php"] [unique_id "acTWhGj3l1y81GYfluR3ggAAAEg"]
[Thu Mar 26 14:47:32.865025 2026] [:error] [pid 19711:tid 19769] [client 20.240.134.170:4069] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filer.php"] [unique_id "acTWhGj3l1y81GYfluR3gwAAAFQ"]
[Thu Mar 26 14:47:33.414091 2026] [:error] [pid 19818:tid 19824] [client 20.240.134.170:3859] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filer.php"] [unique_id "acTWhczaSnm3d1BeM5WDPQAAAMQ"]
[Thu Mar 26 14:47:33.962227 2026] [:error] [pid 31778:tid 31815] [client 20.240.134.170:3937] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filer.php"] [unique_id "acTWhQ3kybI2o-xasmC_EQAAAdY"]
[Thu Mar 26 14:47:34.509327 2026] [:error] [pid 31778:tid 31812] [client 20.240.134.170:3872] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lites.php"] [unique_id "acTWhg3kybI2o-xasmC_FQAAAdM"]
[Thu Mar 26 14:47:35.042407 2026] [:error] [pid 31780:tid 31837] [client 20.240.134.170:3893] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lites.php"] [unique_id "acTWh5JDwZsy5O4ZXEhMewAAAhA"]
[Thu Mar 26 14:47:35.583666 2026] [:error] [pid 31780:tid 31827] [client 20.240.134.170:3862] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lites.php"] [unique_id "acTWh5JDwZsy5O4ZXEhMfQAAAgc"]
[Thu Mar 26 14:47:36.138573 2026] [:error] [pid 31780:tid 31820] [client 20.240.134.170:3791] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lites.php"] [unique_id "acTWiJJDwZsy5O4ZXEhMgQAAAgA"]
[Thu Mar 26 14:47:36.720070 2026] [:error] [pid 31670:tid 31677] [client 20.240.134.170:3782] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cord.php"] [unique_id "acTWiDXVthXxCnWjOTQSUgAAAUU"]
[Thu Mar 26 14:47:37.377797 2026] [:error] [pid 19710:tid 19726] [client 20.240.134.170:3777] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cord.php"] [unique_id "acTWiQVEWP8Ar68Njk7f6AAAAAQ"]
[Thu Mar 26 14:47:37.956538 2026] [:error] [pid 19712:tid 19796] [client 20.240.134.170:3910] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cord.php"] [unique_id "acTWidWhKhRNqm23vFMFpgAAAJQ"]
[Thu Mar 26 14:47:38.493020 2026] [:error] [pid 31670:tid 31695] [client 20.240.134.170:3852] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cord.php"] [unique_id "acTWijXVthXxCnWjOTQSVAAAAVc"]
[Thu Mar 26 14:47:39.046202 2026] [:error] [pid 31717:tid 31740] [client 20.240.134.170:3793] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shlo.php"] [unique_id "acTWi7-SCF7YDISDX4-8FgAAAZI"]
[Thu Mar 26 14:47:39.569752 2026] [:error] [pid 31717:tid 31741] [client 20.240.134.170:3899] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shlo.php"] [unique_id "acTWi7-SCF7YDISDX4-8GAAAAZM"]
[Thu Mar 26 14:47:40.096569 2026] [:error] [pid 19818:tid 19827] [client 20.240.134.170:3792] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shlo.php"] [unique_id "acTWjMzaSnm3d1BeM5WDUgAAAMc"]
[Thu Mar 26 14:47:40.628062 2026] [:error] [pid 19818:tid 19825] [client 20.240.134.170:3886] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shlo.php"] [unique_id "acTWjMzaSnm3d1BeM5WDVwAAAMU"]
[Thu Mar 26 14:47:41.227129 2026] [:error] [pid 31778:tid 31813] [client 20.240.134.170:3808] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gg.php"] [unique_id "acTWjQ3kybI2o-xasmC_GwAAAdQ"]
[Thu Mar 26 14:47:41.799136 2026] [:error] [pid 60829:tid 60836] [client 20.240.134.170:3787] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gg.php"] [unique_id "acTWjfTdjHKeZokybaSMxwAAAQU"]
[Thu Mar 26 14:47:42.394084 2026] [:error] [pid 19711:tid 19762] [client 20.240.134.170:3851] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gg.php"] [unique_id "acTWjmj3l1y81GYfluR3iQAAAE0"]
[Thu Mar 26 14:47:42.971593 2026] [:error] [pid 19818:tid 19833] [client 20.240.134.170:3864] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gg.php"] [unique_id "acTWjszaSnm3d1BeM5WDXwAAAM0"]
[Thu Mar 26 14:47:43.576920 2026] [:error] [pid 19710:tid 19746] [client 20.240.134.170:3880] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/we2.php"] [unique_id "acTWjwVEWP8Ar68Njk7f7gAAABg"]
[Thu Mar 26 14:47:44.105022 2026] [:error] [pid 31670:tid 31677] [client 20.240.134.170:3780] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/we2.php"] [unique_id "acTWkDXVthXxCnWjOTQSWwAAAUU"]
[Thu Mar 26 14:47:44.639069 2026] [:error] [pid 31670:tid 31679] [client 20.240.134.170:3819] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/we2.php"] [unique_id "acTWkDXVthXxCnWjOTQSXAAAAUc"]
[Thu Mar 26 14:47:45.169753 2026] [:error] [pid 19710:tid 19724] [client 20.240.134.170:3806] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/we2.php"] [unique_id "acTWkQVEWP8Ar68Njk7f8QAAAAI"]
[Thu Mar 26 14:47:45.703249 2026] [:error] [pid 31717:tid 31726] [client 20.240.134.170:3894] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/juuuu.php"] [unique_id "acTWkb-SCF7YDISDX4-8IAAAAYQ"]
[Thu Mar 26 14:47:46.241501 2026] [:error] [pid 31780:tid 31836] [client 20.240.134.170:3860] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/juuuu.php"] [unique_id "acTWkpJDwZsy5O4ZXEhMlwAAAg8"]
[Thu Mar 26 14:47:46.822571 2026] [:error] [pid 19710:tid 19722] [client 20.240.134.170:3797] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/juuuu.php"] [unique_id "acTWkgVEWP8Ar68Njk7f9AAAAAA"]
[Thu Mar 26 14:47:47.350556 2026] [:error] [pid 19818:tid 19838] [client 20.240.134.170:3828] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/juuuu.php"] [unique_id "acTWk8zaSnm3d1BeM5WDZgAAANI"]
[Thu Mar 26 14:47:47.942348 2026] [:error] [pid 31780:tid 31845] [client 20.240.134.170:3868] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nox.php"] [unique_id "acTWk5JDwZsy5O4ZXEhMnQAAAhg"]
[Thu Mar 26 14:47:48.492796 2026] [:error] [pid 19818:tid 19828] [client 20.240.134.170:3838] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nox.php"] [unique_id "acTWlMzaSnm3d1BeM5WDaAAAAMg"]
[Thu Mar 26 14:47:49.052291 2026] [:error] [pid 31780:tid 31832] [client 20.240.134.170:3897] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nox.php"] [unique_id "acTWlZJDwZsy5O4ZXEhMoAAAAgs"]
[Thu Mar 26 14:47:49.580866 2026] [:error] [pid 31778:tid 31801] [client 20.240.134.170:3890] [client 20.240.134.170] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nox.php"] [unique_id "acTWlQ3kybI2o-xasmC_JAAAAcg"]
[Thu Mar 26 19:54:33.396365 2026] [:error] [pid 19711:tid 19752] [client 20.111.48.171:64943] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zample.php"] [unique_id "acUeeWj3l1y81GYfluSYGAAAAEM"]
[Thu Mar 26 19:54:34.138160 2026] [:error] [pid 60829:tid 60851] [client 20.111.48.171:64939] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zample.php"] [unique_id "acUeevTdjHKeZokybaTHFwAAARQ"]
[Thu Mar 26 19:54:34.771333 2026] [:error] [pid 19710:tid 19731] [client 20.111.48.171:61789] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zample.php"] [unique_id "acUeegVEWP8Ar68Njk4HjAAAAAk"]
[Thu Mar 26 19:54:35.377314 2026] [:error] [pid 19818:tid 19831] [client 20.111.48.171:62855] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zample.php"] [unique_id "acUee8zaSnm3d1BeM5UWeQAAAMs"]
[Thu Mar 26 19:54:35.999742 2026] [:error] [pid 19712:tid 19777] [client 20.111.48.171:62898] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/read.php"] [unique_id "acUee9WhKhRNqm23vFMiuAAAAIE"]
[Thu Mar 26 19:54:36.581031 2026] [:error] [pid 60829:tid 60855] [client 20.111.48.171:62826] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/read.php"] [unique_id "acUefPTdjHKeZokybaTHHgAAARg"]
[Thu Mar 26 19:54:37.091961 2026] [:error] [pid 19711:tid 19763] [client 20.111.48.171:61882] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/read.php"] [unique_id "acUefWj3l1y81GYfluSYGwAAAE4"]
[Thu Mar 26 19:54:37.678652 2026] [:error] [pid 31778:tid 31815] [client 20.111.48.171:64910] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/read.php"] [unique_id "acUefQ3kybI2o-xasmALXwAAAdY"]
[Thu Mar 26 19:54:38.296032 2026] [:error] [pid 31778:tid 31814] [client 20.111.48.171:61833] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acUefg3kybI2o-xasmALYQAAAdU"]
[Thu Mar 26 19:54:38.828831 2026] [:error] [pid 60829:tid 60848] [client 20.111.48.171:61811] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acUefvTdjHKeZokybaTHIgAAARE"]
[Thu Mar 26 19:54:39.362572 2026] [:error] [pid 31778:tid 31796] [client 20.111.48.171:65040] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acUefw3kybI2o-xasmALZgAAAcM"]
[Thu Mar 26 19:54:39.930609 2026] [:error] [pid 31778:tid 31794] [client 20.111.48.171:64931] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-kd4xalrg7m.php"] [unique_id "acUefw3kybI2o-xasmALagAAAcE"]
[Thu Mar 26 19:54:40.455479 2026] [:error] [pid 60829:tid 60846] [client 20.111.48.171:62871] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acUegPTdjHKeZokybaTHJwAAAQ8"]
[Thu Mar 26 19:54:41.028239 2026] [:error] [pid 19712:tid 19782] [client 20.111.48.171:65028] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acUegdWhKhRNqm23vFMivAAAAIY"]
[Thu Mar 26 19:54:41.588490 2026] [:error] [pid 19712:tid 19793] [client 20.111.48.171:61876] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acUegdWhKhRNqm23vFMiwgAAAJE"]
[Thu Mar 26 19:54:42.187738 2026] [:error] [pid 31717:tid 31738] [client 20.111.48.171:62788] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hplfuns.php"] [unique_id "acUegr-SCF7YDISDX4_qfAAAAZA"]
[Thu Mar 26 19:54:42.689047 2026] [:error] [pid 19710:tid 19742] [client 20.111.48.171:60443] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xa.php"] [unique_id "acUeggVEWP8Ar68Njk4HlQAAABQ"]
[Thu Mar 26 19:54:43.235042 2026] [:error] [pid 19711:tid 19771] [client 20.111.48.171:65054] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xa.php"] [unique_id "acUeg2j3l1y81GYfluSYHgAAAFY"]
[Thu Mar 26 19:54:43.717562 2026] [:error] [pid 19710:tid 19735] [client 20.111.48.171:61812] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xa.php"] [unique_id "acUegwVEWP8Ar68Njk4HmAAAAA0"]
[Thu Mar 26 19:54:44.318184 2026] [:error] [pid 31717:tid 31743] [client 20.111.48.171:64958] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xa.php"] [unique_id "acUehL-SCF7YDISDX4_qgQAAAZU"]
[Thu Mar 26 19:54:44.874367 2026] [:error] [pid 60829:tid 60836] [client 20.111.48.171:62794] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/100.php"] [unique_id "acUehPTdjHKeZokybaTHMwAAAQU"]
[Thu Mar 26 19:54:45.418448 2026] [:error] [pid 60829:tid 60842] [client 20.111.48.171:64930] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/100.php"] [unique_id "acUehfTdjHKeZokybaTHNQAAAQs"]
[Thu Mar 26 19:54:45.922552 2026] [:error] [pid 60829:tid 60848] [client 20.111.48.171:61827] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/100.php"] [unique_id "acUehfTdjHKeZokybaTHOAAAARE"]
[Thu Mar 26 19:54:46.414161 2026] [:error] [pid 31717:tid 31745] [client 20.111.48.171:61808] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/100.php"] [unique_id "acUehr-SCF7YDISDX4_qhAAAAZc"]
[Thu Mar 26 19:54:46.983337 2026] [:error] [pid 19710:tid 19729] [client 20.111.48.171:62861] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless13.php"] [unique_id "acUehgVEWP8Ar68Njk4HmgAAAAc"]
[Thu Mar 26 19:54:47.632665 2026] [:error] [pid 60829:tid 60847] [client 20.111.48.171:65056] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless13.php"] [unique_id "acUeh_TdjHKeZokybaTHPAAAARA"]
[Thu Mar 26 19:54:48.142162 2026] [:error] [pid 19711:tid 19761] [client 20.111.48.171:62870] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless13.php"] [unique_id "acUeiGj3l1y81GYfluSYJQAAAEw"]
[Thu Mar 26 19:54:48.703321 2026] [:error] [pid 31670:tid 31690] [client 20.111.48.171:60466] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless13.php"] [unique_id "acUeiDXVthXxCnWjOTSpFAAAAVI"]
[Thu Mar 26 19:54:49.212245 2026] [:error] [pid 60829:tid 60855] [client 20.111.48.171:65074] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mter.php"] [unique_id "acUeifTdjHKeZokybaTHPgAAARg"]
[Thu Mar 26 19:54:49.725024 2026] [:error] [pid 31780:tid 31827] [client 20.111.48.171:61760] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mter.php"] [unique_id "acUeiZJDwZsy5O4ZXEiuEgAAAgc"]
[Thu Mar 26 19:54:50.583207 2026] [:error] [pid 31780:tid 31829] [client 20.111.48.171:62851] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mter.php"] [unique_id "acUeipJDwZsy5O4ZXEiuGwAAAgg"]
[Thu Mar 26 19:54:51.177993 2026] [:error] [pid 31780:tid 31836] [client 20.111.48.171:64947] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-mter.php"] [unique_id "acUei5JDwZsy5O4ZXEiuIAAAAg8"]
[Thu Mar 26 19:54:51.743975 2026] [:error] [pid 31670:tid 31674] [client 20.111.48.171:62863] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acUeizXVthXxCnWjOTSpFwAAAUI"]
[Thu Mar 26 19:54:52.269220 2026] [:error] [pid 60829:tid 60832] [client 20.111.48.171:65055] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acUejPTdjHKeZokybaTHQAAAAQE"]
[Thu Mar 26 19:54:52.858171 2026] [:error] [pid 31670:tid 31696] [client 20.111.48.171:62790] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acUejDXVthXxCnWjOTSpGwAAAVg"]
[Thu Mar 26 19:54:53.415515 2026] [:error] [pid 31670:tid 31685] [client 20.111.48.171:61809] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acUejTXVthXxCnWjOTSpIgAAAU0"]
[Thu Mar 26 19:54:53.989944 2026] [:error] [pid 31670:tid 31690] [client 20.111.48.171:65039] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/19.php"] [unique_id "acUejTXVthXxCnWjOTSpKQAAAVI"]
[Thu Mar 26 19:54:54.496607 2026] [:error] [pid 31780:tid 31823] [client 20.111.48.171:62857] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/19.php"] [unique_id "acUejpJDwZsy5O4ZXEiuKwAAAgM"]
[Thu Mar 26 19:54:55.003113 2026] [:error] [pid 19818:tid 19839] [client 20.111.48.171:62844] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/19.php"] [unique_id "acUej8zaSnm3d1BeM5UWiwAAANM"]
[Thu Mar 26 19:54:55.515497 2026] [:error] [pid 19818:tid 19835] [client 20.111.48.171:65050] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/19.php"] [unique_id "acUej8zaSnm3d1BeM5UWjgAAAM8"]
[Thu Mar 26 19:54:56.043020 2026] [:error] [pid 19818:tid 19832] [client 20.111.48.171:61874] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acUekMzaSnm3d1BeM5UWkwAAAMw"]
[Thu Mar 26 19:54:56.912166 2026] [:error] [pid 19818:tid 19829] [client 20.111.48.171:62875] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acUekMzaSnm3d1BeM5UWmwAAAMk"]
[Thu Mar 26 19:54:57.410465 2026] [:error] [pid 19818:tid 19838] [client 20.111.48.171:61830] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acUekczaSnm3d1BeM5UWngAAANI"]
[Thu Mar 26 19:54:57.960329 2026] [:error] [pid 19710:tid 19740] [client 20.111.48.171:60430] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acUekQVEWP8Ar68Njk4HpwAAABI"]
[Thu Mar 26 19:54:58.618338 2026] [:error] [pid 31717:tid 31734] [client 20.111.48.171:62868] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file61.php"] [unique_id "acUekr-SCF7YDISDX4_qiwAAAYw"]
[Thu Mar 26 19:54:59.424937 2026] [:error] [pid 31670:tid 31676] [client 20.111.48.171:60362] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file61.php"] [unique_id "acUekzXVthXxCnWjOTSpNwAAAUQ"]
[Thu Mar 26 19:54:59.960041 2026] [:error] [pid 31670:tid 31686] [client 20.111.48.171:64923] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file61.php"] [unique_id "acUekzXVthXxCnWjOTSpOAAAAU4"]
[Thu Mar 26 19:55:00.501903 2026] [:error] [pid 19818:tid 19836] [client 20.111.48.171:62815] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file61.php"] [unique_id "acUelMzaSnm3d1BeM5UWpAAAANA"]
[Thu Mar 26 19:55:01.039334 2026] [:error] [pid 60829:tid 60846] [client 20.111.48.171:62791] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acUelfTdjHKeZokybaTHRwAAAQ8"]
[Thu Mar 26 19:55:01.553530 2026] [:error] [pid 31670:tid 31690] [client 20.111.48.171:60395] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acUelTXVthXxCnWjOTSpPQAAAVI"]
[Thu Mar 26 19:55:02.126924 2026] [:error] [pid 31780:tid 31835] [client 20.111.48.171:65053] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acUelpJDwZsy5O4ZXEiuMgAAAg4"]
[Thu Mar 26 19:55:02.802154 2026] [:error] [pid 31778:tid 31811] [client 20.111.48.171:61807] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acUelg3kybI2o-xasmALdgAAAdI"]
[Thu Mar 26 19:55:03.379009 2026] [:error] [pid 19818:tid 19823] [client 20.111.48.171:61797] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/settings.php"] [unique_id "acUel8zaSnm3d1BeM5UWrgAAAMM"]
[Thu Mar 26 19:55:03.897014 2026] [:error] [pid 31670:tid 31692] [client 20.111.48.171:65082] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/settings.php"] [unique_id "acUelzXVthXxCnWjOTSpSwAAAVQ"]
[Thu Mar 26 19:55:04.440433 2026] [:error] [pid 19818:tid 19834] [client 20.111.48.171:65083] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/settings.php"] [unique_id "acUemMzaSnm3d1BeM5UWuQAAAM4"]
[Thu Mar 26 19:55:04.953134 2026] [:error] [pid 31670:tid 31687] [client 20.111.48.171:57193] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/settings.php"] [unique_id "acUemDXVthXxCnWjOTSpTwAAAU8"]
[Thu Mar 26 19:55:05.465514 2026] [:error] [pid 31670:tid 31696] [client 20.111.48.171:61843] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sf.php"] [unique_id "acUemTXVthXxCnWjOTSpUwAAAVg"]
[Thu Mar 26 19:55:06.000201 2026] [:error] [pid 31670:tid 31692] [client 20.111.48.171:62799] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sf.php"] [unique_id "acUemTXVthXxCnWjOTSpVwAAAVQ"]
[Thu Mar 26 19:55:06.576322 2026] [:error] [pid 31780:tid 31844] [client 20.111.48.171:61835] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sf.php"] [unique_id "acUempJDwZsy5O4ZXEiuOAAAAhc"]
[Thu Mar 26 19:55:07.174405 2026] [:error] [pid 19712:tid 19790] [client 20.111.48.171:65048] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sf.php"] [unique_id "acUem9WhKhRNqm23vFMi0QAAAI4"]
[Thu Mar 26 19:55:07.695453 2026] [:error] [pid 31780:tid 31820] [client 20.111.48.171:65062] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acUem5JDwZsy5O4ZXEiuPAAAAgA"]
[Thu Mar 26 19:55:08.306914 2026] [:error] [pid 31778:tid 31810] [client 20.111.48.171:59079] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acUenA3kybI2o-xasmALfgAAAdE"]
[Thu Mar 26 19:55:08.846365 2026] [:error] [pid 31778:tid 31804] [client 20.111.48.171:60398] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acUenA3kybI2o-xasmALgAAAAcs"]
[Thu Mar 26 19:55:09.399858 2026] [:error] [pid 31778:tid 31817] [client 20.111.48.171:60447] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acUenQ3kybI2o-xasmALggAAAdg"]
[Thu Mar 26 19:55:09.920028 2026] [:error] [pid 31778:tid 31815] [client 20.111.48.171:60469] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "acUenQ3kybI2o-xasmALgwAAAdY"]
[Thu Mar 26 19:55:10.409482 2026] [:error] [pid 31778:tid 31814] [client 20.111.48.171:61814] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "acUeng3kybI2o-xasmALhwAAAdU"]
[Thu Mar 26 19:55:10.991611 2026] [:error] [pid 31717:tid 31731] [client 20.111.48.171:61877] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "acUenr-SCF7YDISDX4_qjwAAAYk"]
[Thu Mar 26 19:55:11.564211 2026] [:error] [pid 19818:tid 19828] [client 20.111.48.171:53839] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "acUen8zaSnm3d1BeM5UWwgAAAMg"]
[Thu Mar 26 19:55:12.117455 2026] [:error] [pid 19711:tid 19755] [client 20.111.48.171:61810] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/w2025.php"] [unique_id "acUeoGj3l1y81GYfluSYOgAAAEY"]
[Thu Mar 26 19:55:12.611353 2026] [:error] [pid 31778:tid 31794] [client 20.111.48.171:65024] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/w2025.php"] [unique_id "acUeoA3kybI2o-xasmALjAAAAcE"]
[Thu Mar 26 19:55:13.098868 2026] [:error] [pid 19711:tid 19754] [client 20.111.48.171:65052] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/w2025.php"] [unique_id "acUeoWj3l1y81GYfluSYPAAAAEU"]
[Thu Mar 26 19:55:13.599824 2026] [:error] [pid 31670:tid 31694] [client 20.111.48.171:61810] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/w2025.php"] [unique_id "acUeoTXVthXxCnWjOTSpcwAAAVY"]
[Thu Mar 26 19:55:14.160476 2026] [:error] [pid 19818:tid 19824] [client 20.111.48.171:59119] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/swallowable.php"] [unique_id "acUeoszaSnm3d1BeM5UWywAAAMQ"]
[Thu Mar 26 19:55:14.688646 2026] [:error] [pid 31670:tid 31684] [client 20.111.48.171:62784] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/swallowable.php"] [unique_id "acUeojXVthXxCnWjOTSpewAAAUw"]
[Thu Mar 26 19:55:15.289602 2026] [:error] [pid 31670:tid 31682] [client 20.111.48.171:60425] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/swallowable.php"] [unique_id "acUeozXVthXxCnWjOTSpfwAAAUo"]
[Thu Mar 26 19:55:15.847038 2026] [:error] [pid 31670:tid 31695] [client 20.111.48.171:60368] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/swallowable.php"] [unique_id "acUeozXVthXxCnWjOTSpgwAAAVc"]
[Thu Mar 26 19:55:16.418483 2026] [:error] [pid 31780:tid 31823] [client 20.111.48.171:60372] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fvvff.php"] [unique_id "acUepJJDwZsy5O4ZXEiuTAAAAgM"]
[Thu Mar 26 19:55:16.953764 2026] [:error] [pid 31778:tid 31802] [client 20.111.48.171:60377] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fvvff.php"] [unique_id "acUepA3kybI2o-xasmALjgAAAck"]
[Thu Mar 26 19:55:17.547586 2026] [:error] [pid 31778:tid 31799] [client 20.111.48.171:65057] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fvvff.php"] [unique_id "acUepQ3kybI2o-xasmALkQAAAcY"]
[Thu Mar 26 19:55:18.123631 2026] [:error] [pid 60829:tid 60844] [client 20.111.48.171:57186] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fvvff.php"] [unique_id "acUepvTdjHKeZokybaTHUAAAAQ0"]
[Thu Mar 26 19:55:19.115654 2026] [:error] [pid 31780:tid 31820] [client 20.111.48.171:60441] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a2.php"] [unique_id "acUep5JDwZsy5O4ZXEiuVAAAAgA"]
[Thu Mar 26 19:55:19.676723 2026] [:error] [pid 19711:tid 19770] [client 20.111.48.171:64900] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a2.php"] [unique_id "acUep2j3l1y81GYfluSYPwAAAFU"]
[Thu Mar 26 19:55:20.271155 2026] [:error] [pid 31717:tid 31736] [client 20.111.48.171:65078] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a2.php"] [unique_id "acUeqL-SCF7YDISDX4_qkwAAAY4"]
[Thu Mar 26 19:55:20.756810 2026] [:error] [pid 31670:tid 31688] [client 20.111.48.171:61764] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a2.php"] [unique_id "acUeqDXVthXxCnWjOTSpmAAAAVA"]
[Thu Mar 26 19:55:31.752758 2026] [:error] [pid 60829:tid 60853] [client 20.111.48.171:56864] [client 20.111.48.171] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.111.48.171, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acUes_TdjHKeZokybaTHbAAAARY"]
[Thu Mar 26 19:55:38.058725 2026] [:error] [pid 60829:tid 60837] [client 20.111.48.171:56864] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acUeuvTdjHKeZokybaTHcgAAAQY"]
[Thu Mar 26 19:55:38.568208 2026] [:error] [pid 19818:tid 19838] [client 20.111.48.171:65027] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acUeuszaSnm3d1BeM5UXAgAAANI"]
[Thu Mar 26 19:55:39.080679 2026] [:error] [pid 31778:tid 31813] [client 20.111.48.171:61815] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acUeuw3kybI2o-xasmALuQAAAdQ"]
[Thu Mar 26 19:55:39.570626 2026] [:error] [pid 31670:tid 31696] [client 20.111.48.171:61860] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acUeuzXVthXxCnWjOTSpoAAAAVg"]
[Thu Mar 26 19:55:40.065488 2026] [:error] [pid 31670:tid 31672] [client 20.111.48.171:64924] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acUevDXVthXxCnWjOTSpogAAAUA"]
[Thu Mar 26 19:55:40.580808 2026] [:error] [pid 31670:tid 31689] [client 20.111.48.171:64913] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acUevDXVthXxCnWjOTSppwAAAVE"]
[Thu Mar 26 19:55:41.073974 2026] [:error] [pid 31670:tid 31679] [client 20.111.48.171:65044] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acUevTXVthXxCnWjOTSpqgAAAUc"]
[Thu Mar 26 19:55:41.575535 2026] [:error] [pid 31670:tid 31674] [client 20.111.48.171:60448] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acUevTXVthXxCnWjOTSprgAAAUI"]
[Thu Mar 26 19:55:42.182869 2026] [:error] [pid 31670:tid 31689] [client 20.111.48.171:64934] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acUevjXVthXxCnWjOTSpswAAAVE"]
[Thu Mar 26 19:55:42.702268 2026] [:error] [pid 31778:tid 31802] [client 20.111.48.171:58667] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acUevg3kybI2o-xasmALvgAAAck"]
[Thu Mar 26 19:55:43.264892 2026] [:error] [pid 31717:tid 31736] [client 20.111.48.171:64932] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acUev7-SCF7YDISDX4_qtwAAAY4"]
[Thu Mar 26 19:55:43.877197 2026] [:error] [pid 60829:tid 60848] [client 20.111.48.171:61822] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "acUev_TdjHKeZokybaTHdQAAARE"]
[Thu Mar 26 19:55:44.366795 2026] [:error] [pid 60829:tid 60840] [client 20.111.48.171:61837] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "acUewPTdjHKeZokybaTHdgAAAQk"]
[Thu Mar 26 19:55:44.839720 2026] [:error] [pid 60829:tid 60854] [client 20.111.48.171:64956] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "acUewPTdjHKeZokybaTHeQAAARc"]
[Thu Mar 26 19:55:45.352884 2026] [:error] [pid 31670:tid 31684] [client 20.111.48.171:62883] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "acUewTXVthXxCnWjOTSptgAAAUw"]
[Thu Mar 26 19:55:45.907335 2026] [:error] [pid 31780:tid 31825] [client 20.111.48.171:65059] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "acUewZJDwZsy5O4ZXEiuewAAAgU"]
[Thu Mar 26 19:55:46.411453 2026] [:error] [pid 31670:tid 31687] [client 20.111.48.171:62853] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acUewjXVthXxCnWjOTSptwAAAU8"]
[Thu Mar 26 19:55:46.931488 2026] [:error] [pid 31778:tid 31807] [client 20.111.48.171:60401] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acUewg3kybI2o-xasmALxgAAAc4"]
[Thu Mar 26 19:55:47.481298 2026] [:error] [pid 19711:tid 19754] [client 20.111.48.171:60416] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acUew2j3l1y81GYfluSYRwAAAEU"]
[Thu Mar 26 19:55:47.961771 2026] [:error] [pid 60829:tid 60838] [client 20.111.48.171:61884] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acUew_TdjHKeZokybaTHgAAAAQc"]
[Thu Mar 26 19:55:48.497108 2026] [:error] [pid 19710:tid 19724] [client 20.111.48.171:65087] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file59.php"] [unique_id "acUexAVEWP8Ar68Njk4HxAAAAAI"]
[Thu Mar 26 19:55:48.992263 2026] [:error] [pid 19710:tid 19727] [client 20.111.48.171:60460] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file59.php"] [unique_id "acUexAVEWP8Ar68Njk4HxgAAAAU"]
[Thu Mar 26 19:55:49.559299 2026] [:error] [pid 31717:tid 31722] [client 20.111.48.171:65035] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file59.php"] [unique_id "acUexb-SCF7YDISDX4_qvgAAAYA"]
[Thu Mar 26 19:55:50.055194 2026] [:error] [pid 19818:tid 19823] [client 20.111.48.171:58679] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file59.php"] [unique_id "acUexszaSnm3d1BeM5UXEgAAAMM"]
[Thu Mar 26 19:55:50.563768 2026] [:error] [pid 31778:tid 31806] [client 20.111.48.171:60378] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless5.php"] [unique_id "acUexg3kybI2o-xasmALywAAAc0"]
[Thu Mar 26 19:55:51.072777 2026] [:error] [pid 31778:tid 31809] [client 20.111.48.171:57174] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless5.php"] [unique_id "acUexw3kybI2o-xasmALzAAAAdA"]
[Thu Mar 26 19:55:51.650672 2026] [:error] [pid 19710:tid 19738] [client 20.111.48.171:64926] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless5.php"] [unique_id "acUexwVEWP8Ar68Njk4HyQAAABA"]
[Thu Mar 26 19:55:52.213457 2026] [:error] [pid 31780:tid 31821] [client 20.111.48.171:60454] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless5.php"] [unique_id "acUeyJJDwZsy5O4ZXEiuggAAAgE"]
[Thu Mar 26 19:55:52.743076 2026] [:error] [pid 19818:tid 19827] [client 20.111.48.171:64930] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acUeyMzaSnm3d1BeM5UXEwAAAMc"]
[Thu Mar 26 19:55:53.252051 2026] [:error] [pid 31670:tid 31686] [client 20.111.48.171:60393] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acUeyTXVthXxCnWjOTSpuwAAAU4"]
[Thu Mar 26 19:55:53.792284 2026] [:error] [pid 31670:tid 31694] [client 20.111.48.171:61778] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acUeyTXVthXxCnWjOTSpvAAAAVY"]
[Thu Mar 26 19:55:54.295365 2026] [:error] [pid 31670:tid 31692] [client 20.111.48.171:61793] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "acUeyjXVthXxCnWjOTSpvgAAAVQ"]
[Thu Mar 26 19:55:54.815595 2026] [:error] [pid 19711:tid 19768] [client 20.111.48.171:61785] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xqq.php"] [unique_id "acUeymj3l1y81GYfluSYSgAAAFM"]
[Thu Mar 26 19:55:55.301699 2026] [:error] [pid 31780:tid 31837] [client 20.111.48.171:60353] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xqq.php"] [unique_id "acUey5JDwZsy5O4ZXEiuhwAAAhA"]
[Thu Mar 26 19:55:56.061014 2026] [:error] [pid 60829:tid 60832] [client 20.111.48.171:61873] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xqq.php"] [unique_id "acUezPTdjHKeZokybaTHjwAAAQE"]
[Thu Mar 26 19:55:56.599535 2026] [:error] [pid 31778:tid 31807] [client 20.111.48.171:60424] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xqq.php"] [unique_id "acUezA3kybI2o-xasmAL0AAAAc4"]
[Thu Mar 26 19:55:57.134103 2026] [:error] [pid 31670:tid 31696] [client 20.111.48.171:58670] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plss3.php"] [unique_id "acUezTXVthXxCnWjOTSpwwAAAVg"]
[Thu Mar 26 19:55:57.648791 2026] [:error] [pid 31670:tid 31675] [client 20.111.48.171:61838] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plss3.php"] [unique_id "acUezTXVthXxCnWjOTSpxAAAAUM"]
[Thu Mar 26 19:55:58.145611 2026] [:error] [pid 31670:tid 31676] [client 20.111.48.171:64912] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plss3.php"] [unique_id "acUezjXVthXxCnWjOTSpyQAAAUQ"]
[Thu Mar 26 19:55:58.634970 2026] [:error] [pid 31778:tid 31802] [client 20.111.48.171:61856] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plss3.php"] [unique_id "acUezg3kybI2o-xasmAL0QAAAck"]
[Thu Mar 26 19:55:59.162969 2026] [:error] [pid 31778:tid 31801] [client 20.111.48.171:61816] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aaa.php"] [unique_id "acUezw3kybI2o-xasmAL0wAAAcg"]
[Thu Mar 26 19:55:59.669569 2026] [:error] [pid 31778:tid 31813] [client 20.111.48.171:60358] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aaa.php"] [unique_id "acUezw3kybI2o-xasmAL1gAAAdQ"]
[Thu Mar 26 19:56:00.198185 2026] [:error] [pid 31778:tid 31811] [client 20.111.48.171:61796] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aaa.php"] [unique_id "acUe0A3kybI2o-xasmAL3QAAAdI"]
[Thu Mar 26 19:56:00.739739 2026] [:error] [pid 31780:tid 31821] [client 20.111.48.171:60364] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aaa.php"] [unique_id "acUe0JJDwZsy5O4ZXEiujQAAAgE"]
[Thu Mar 26 19:56:01.232426 2026] [:error] [pid 31780:tid 31841] [client 20.111.48.171:62795] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/classwithtostring.php"] [unique_id "acUe0ZJDwZsy5O4ZXEiukQAAAhQ"]
[Thu Mar 26 19:56:01.723876 2026] [:error] [pid 31780:tid 31831] [client 20.111.48.171:61765] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/classwithtostring.php"] [unique_id "acUe0ZJDwZsy5O4ZXEiulgAAAgo"]
[Thu Mar 26 19:56:02.248449 2026] [:error] [pid 31780:tid 31844] [client 20.111.48.171:60396] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/classwithtostring.php"] [unique_id "acUe0pJDwZsy5O4ZXEiumQAAAhc"]
[Thu Mar 26 19:56:02.810822 2026] [:error] [pid 19712:tid 19790] [client 20.111.48.171:62841] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/classwithtostring.php"] [unique_id "acUe0tWhKhRNqm23vFMi7gAAAI4"]
[Thu Mar 26 19:56:03.303738 2026] [:error] [pid 19712:tid 19789] [client 20.111.48.171:64902] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "acUe09WhKhRNqm23vFMi7wAAAI0"]
[Thu Mar 26 19:56:03.787484 2026] [:error] [pid 31780:tid 31838] [client 20.111.48.171:60465] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "acUe05JDwZsy5O4ZXEiunwAAAhE"]
[Thu Mar 26 19:56:04.285007 2026] [:error] [pid 19818:tid 19827] [client 20.111.48.171:61768] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "acUe1MzaSnm3d1BeM5UXHgAAAMc"]
[Thu Mar 26 19:56:04.821019 2026] [:error] [pid 19710:tid 19723] [client 20.111.48.171:62854] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "acUe1AVEWP8Ar68Njk4HzwAAAAE"]
[Thu Mar 26 19:56:05.322918 2026] [:error] [pid 60829:tid 60847] [client 20.111.48.171:61773] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "acUe1fTdjHKeZokybaTHlQAAARA"]
[Thu Mar 26 19:56:05.833744 2026] [:error] [pid 19710:tid 19724] [client 20.111.48.171:60375] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "acUe1QVEWP8Ar68Njk4H0QAAAAI"]
[Thu Mar 26 19:56:06.357189 2026] [:error] [pid 19710:tid 19728] [client 20.111.48.171:65045] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "acUe1gVEWP8Ar68Njk4H0wAAAAY"]
[Thu Mar 26 19:56:06.944595 2026] [:error] [pid 31780:tid 31830] [client 20.111.48.171:62813] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "acUe1pJDwZsy5O4ZXEiupQAAAgk"]
[Thu Mar 26 19:56:07.445643 2026] [:error] [pid 19710:tid 19745] [client 20.111.48.171:62796] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms.php"] [unique_id "acUe1wVEWP8Ar68Njk4H1AAAABc"]
[Thu Mar 26 19:56:07.960659 2026] [:error] [pid 19712:tid 19799] [client 20.111.48.171:62789] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms.php"] [unique_id "acUe19WhKhRNqm23vFMi8QAAAJc"]
[Thu Mar 26 19:56:08.546834 2026] [:error] [pid 19818:tid 19826] [client 20.111.48.171:60370] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms.php"] [unique_id "acUe2MzaSnm3d1BeM5UXJgAAAMY"]
[Thu Mar 26 19:56:09.025353 2026] [:error] [pid 31778:tid 31814] [client 20.111.48.171:62847] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms.php"] [unique_id "acUe2Q3kybI2o-xasmAL5gAAAdU"]
[Thu Mar 26 19:56:09.556279 2026] [:error] [pid 19818:tid 19842] [client 20.111.48.171:60394] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "acUe2czaSnm3d1BeM5UXKgAAANY"]
[Thu Mar 26 19:56:10.050693 2026] [:error] [pid 31780:tid 31845] [client 20.111.48.171:59121] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "acUe2pJDwZsy5O4ZXEiuqAAAAhg"]
[Thu Mar 26 19:56:10.558310 2026] [:error] [pid 31780:tid 31841] [client 20.111.48.171:60366] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "acUe2pJDwZsy5O4ZXEiurgAAAhQ"]
[Thu Mar 26 19:56:11.069909 2026] [:error] [pid 31780:tid 31820] [client 20.111.48.171:59098] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "acUe25JDwZsy5O4ZXEiusgAAAgA"]
[Thu Mar 26 19:56:11.570914 2026] [:error] [pid 31780:tid 31825] [client 20.111.48.171:62878] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sbhu.php"] [unique_id "acUe25JDwZsy5O4ZXEiutgAAAgU"]
[Thu Mar 26 19:56:12.120710 2026] [:error] [pid 31670:tid 31692] [client 20.111.48.171:62817] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sbhu.php"] [unique_id "acUe3DXVthXxCnWjOTSp0QAAAVQ"]
[Thu Mar 26 19:56:12.651760 2026] [:error] [pid 31778:tid 31816] [client 20.111.48.171:60414] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sbhu.php"] [unique_id "acUe3A3kybI2o-xasmAL6QAAAdc"]
[Thu Mar 26 19:56:13.190121 2026] [:error] [pid 31717:tid 31740] [client 20.111.48.171:56847] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sbhu.php"] [unique_id "acUe3b-SCF7YDISDX4_qxgAAAZI"]
[Thu Mar 26 19:56:13.684332 2026] [:error] [pid 19712:tid 19786] [client 20.111.48.171:61770] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acUe3dWhKhRNqm23vFMi8gAAAIo"]
[Thu Mar 26 19:56:14.243628 2026] [:error] [pid 31717:tid 31736] [client 20.111.48.171:55311] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acUe3r-SCF7YDISDX4_qyAAAAY4"]
[Thu Mar 26 19:56:14.777217 2026] [:error] [pid 31778:tid 31797] [client 20.111.48.171:61861] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acUe3g3kybI2o-xasmAL7QAAAcQ"]
[Thu Mar 26 19:56:15.326975 2026] [:error] [pid 60829:tid 60850] [client 20.111.48.171:60440] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acUe3_TdjHKeZokybaTHnwAAARM"]
[Thu Mar 26 19:56:15.852183 2026] [:error] [pid 19710:tid 19739] [client 20.111.48.171:62877] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/test1.php"] [unique_id "acUe3wVEWP8Ar68Njk4H1gAAABE"]
[Thu Mar 26 19:56:16.354624 2026] [:error] [pid 31670:tid 31683] [client 20.111.48.171:61839] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/test1.php"] [unique_id "acUe4DXVthXxCnWjOTSp2QAAAUs"]
[Thu Mar 26 19:56:16.895498 2026] [:error] [pid 31717:tid 31744] [client 20.111.48.171:61847] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/test1.php"] [unique_id "acUe4L-SCF7YDISDX4_qzgAAAZY"]
[Thu Mar 26 19:56:17.446163 2026] [:error] [pid 31717:tid 31726] [client 20.111.48.171:64935] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/test1.php"] [unique_id "acUe4b-SCF7YDISDX4_q0gAAAYQ"]
[Thu Mar 26 19:56:17.957824 2026] [:error] [pid 31717:tid 31728] [client 20.111.48.171:61836] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "acUe4b-SCF7YDISDX4_q1AAAAYY"]
[Thu Mar 26 19:56:18.462995 2026] [:error] [pid 31717:tid 31729] [client 20.111.48.171:64951] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "acUe4r-SCF7YDISDX4_q2gAAAYc"]
[Thu Mar 26 19:56:19.020393 2026] [:error] [pid 31717:tid 31746] [client 20.111.48.171:60418] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "acUe47-SCF7YDISDX4_q3QAAAZg"]
[Thu Mar 26 19:56:19.544660 2026] [:error] [pid 19711:tid 19757] [client 20.111.48.171:61803] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/"] [unique_id "acUe42j3l1y81GYfluSYUAAAAEg"]
[Thu Mar 26 19:56:20.063576 2026] [:error] [pid 60829:tid 60842] [client 20.111.48.171:65029] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/166.php"] [unique_id "acUe5PTdjHKeZokybaTHpgAAAQs"]
[Thu Mar 26 19:56:20.631558 2026] [:error] [pid 19711:tid 19759] [client 20.111.48.171:61869] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/166.php"] [unique_id "acUe5Gj3l1y81GYfluSYUgAAAEo"]
[Thu Mar 26 19:56:21.115840 2026] [:error] [pid 19710:tid 19737] [client 20.111.48.171:62867] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/166.php"] [unique_id "acUe5QVEWP8Ar68Njk4H3gAAAA8"]
[Thu Mar 26 19:56:21.592963 2026] [:error] [pid 19712:tid 19796] [client 20.111.48.171:60449] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/166.php"] [unique_id "acUe5dWhKhRNqm23vFMi9wAAAJQ"]
[Thu Mar 26 19:56:22.069772 2026] [:error] [pid 31778:tid 31794] [client 20.111.48.171:60431] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acUe5g3kybI2o-xasmAL9gAAAcE"]
[Thu Mar 26 19:56:22.576799 2026] [:error] [pid 19710:tid 19746] [client 20.111.48.171:64919] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acUe5gVEWP8Ar68Njk4H4wAAABg"]
[Thu Mar 26 19:56:23.068795 2026] [:error] [pid 31778:tid 31793] [client 20.111.48.171:65034] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acUe5w3kybI2o-xasmAL9wAAAcA"]
[Thu Mar 26 19:56:23.600680 2026] [:error] [pid 19818:tid 19825] [client 20.111.48.171:65064] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "acUe58zaSnm3d1BeM5UXNQAAAMU"]
[Thu Mar 26 19:56:24.161511 2026] [:error] [pid 19712:tid 19781] [client 20.111.48.171:61834] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acUe6NWhKhRNqm23vFMi-wAAAIU"]
[Thu Mar 26 19:56:24.738671 2026] [:error] [pid 31717:tid 31738] [client 20.111.48.171:61881] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acUe6L-SCF7YDISDX4_q4QAAAZA"]
[Thu Mar 26 19:56:25.280906 2026] [:error] [pid 19818:tid 19830] [client 20.111.48.171:62840] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acUe6czaSnm3d1BeM5UXOQAAAMo"]
[Thu Mar 26 19:56:25.781297 2026] [:error] [pid 31778:tid 31796] [client 20.111.48.171:61841] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acUe6Q3kybI2o-xasmAL_AAAAcM"]
[Thu Mar 26 19:56:26.283925 2026] [:error] [pid 31780:tid 31824] [client 20.111.48.171:60438] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/adminfuns.php"] [unique_id "acUe6pJDwZsy5O4ZXEiuvAAAAgQ"]
[Thu Mar 26 19:56:26.840287 2026] [:error] [pid 19818:tid 19833] [client 20.111.48.171:65042] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/adminfuns.php"] [unique_id "acUe6szaSnm3d1BeM5UXPgAAAM0"]
[Thu Mar 26 19:56:27.320551 2026] [:error] [pid 19710:tid 19722] [client 20.111.48.171:62865] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/adminfuns.php"] [unique_id "acUe6wVEWP8Ar68Njk4H7AAAAAA"]
[Thu Mar 26 19:56:27.803741 2026] [:error] [pid 31778:tid 31798] [client 20.111.48.171:60386] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/adminfuns.php"] [unique_id "acUe6w3kybI2o-xasmAL_wAAAcU"]
[Thu Mar 26 19:56:28.326911 2026] [:error] [pid 19712:tid 19783] [client 20.111.48.171:60359] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goods.php"] [unique_id "acUe7NWhKhRNqm23vFMi_wAAAIc"]
[Thu Mar 26 19:56:28.801660 2026] [:error] [pid 19818:tid 19831] [client 20.111.48.171:61887] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goods.php"] [unique_id "acUe7MzaSnm3d1BeM5UXRQAAAMs"]
[Thu Mar 26 19:56:29.322178 2026] [:error] [pid 31670:tid 31689] [client 20.111.48.171:60354] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goods.php"] [unique_id "acUe7TXVthXxCnWjOTSp6wAAAVE"]
[Thu Mar 26 19:56:29.835470 2026] [:error] [pid 31670:tid 31686] [client 20.111.48.171:64904] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goods.php"] [unique_id "acUe7TXVthXxCnWjOTSp8wAAAU4"]
[Thu Mar 26 19:56:30.323250 2026] [:error] [pid 31670:tid 31672] [client 20.111.48.171:62861] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acUe7jXVthXxCnWjOTSp9wAAAUA"]
[Thu Mar 26 19:56:30.908909 2026] [:error] [pid 31778:tid 31811] [client 20.111.48.171:60445] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acUe7g3kybI2o-xasmAMAgAAAdI"]
[Thu Mar 26 19:56:31.437864 2026] [:error] [pid 31780:tid 31841] [client 20.111.48.171:65046] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acUe75JDwZsy5O4ZXEiuwQAAAhQ"]
[Thu Mar 26 19:56:31.962730 2026] [:error] [pid 31778:tid 31817] [client 20.111.48.171:61819] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-edit.php"] [unique_id "acUe7w3kybI2o-xasmAMAwAAAdg"]
[Thu Mar 26 19:56:32.467430 2026] [:error] [pid 31778:tid 31802] [client 20.111.48.171:59082] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acUe8A3kybI2o-xasmAMBwAAAck"]
[Thu Mar 26 19:56:32.969312 2026] [:error] [pid 31670:tid 31689] [client 20.111.48.171:62862] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acUe8DXVthXxCnWjOTSp_AAAAVE"]
[Thu Mar 26 19:56:33.453740 2026] [:error] [pid 31670:tid 31677] [client 20.111.48.171:62800] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acUe8TXVthXxCnWjOTSp_wAAAUU"]
[Thu Mar 26 19:56:33.932400 2026] [:error] [pid 19818:tid 19822] [client 20.111.48.171:60369] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acUe8czaSnm3d1BeM5UXUQAAAMI"]
[Thu Mar 26 19:56:34.432597 2026] [:error] [pid 19818:tid 19820] [client 20.111.48.171:58686] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acUe8szaSnm3d1BeM5UXUwAAAMA"]
[Thu Mar 26 19:56:34.929330 2026] [:error] [pid 31778:tid 31801] [client 20.111.48.171:57196] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acUe8g3kybI2o-xasmAMCQAAAcg"]
[Thu Mar 26 19:56:35.420940 2026] [:error] [pid 19818:tid 19837] [client 20.111.48.171:60379] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acUe88zaSnm3d1BeM5UXVQAAANE"]
[Thu Mar 26 19:56:35.941169 2026] [:error] [pid 19712:tid 19786] [client 20.111.48.171:64949] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cgi-bin/index.php"] [unique_id "acUe89WhKhRNqm23vFMjDwAAAIo"]
[Thu Mar 26 19:56:54.490434 2026] [:error] [pid 60829:tid 60835] [client 20.111.48.171:62888] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp.php"] [unique_id "acUfBvTdjHKeZokybaTHwwAAAQQ"]
[Thu Mar 26 19:56:54.969907 2026] [:error] [pid 31778:tid 31816] [client 20.111.48.171:56853] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp.php"] [unique_id "acUfBg3kybI2o-xasmAMGgAAAdc"]
[Thu Mar 26 19:56:55.687691 2026] [:error] [pid 31670:tid 31690] [client 20.111.48.171:57154] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp.php"] [unique_id "acUfBzXVthXxCnWjOTSqLwAAAVI"]
[Thu Mar 26 19:56:56.274751 2026] [:error] [pid 31670:tid 31680] [client 20.111.48.171:61879] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp.php"] [unique_id "acUfCDXVthXxCnWjOTSqMwAAAUg"]
[Thu Mar 26 19:56:57.121192 2026] [:error] [pid 19712:tid 19786] [client 20.111.48.171:61818] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "acUfCdWhKhRNqm23vFMjGQAAAIo"]
[Thu Mar 26 19:56:57.605605 2026] [:error] [pid 31670:tid 31676] [client 20.111.48.171:61875] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "acUfCTXVthXxCnWjOTSqOgAAAUQ"]
[Thu Mar 26 19:56:58.100585 2026] [:error] [pid 19818:tid 19825] [client 20.111.48.171:61820] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "acUfCszaSnm3d1BeM5UXjwAAAMU"]
[Thu Mar 26 19:56:58.605002 2026] [:error] [pid 31670:tid 31689] [client 20.111.48.171:60392] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/fi.php"] [unique_id "acUfCjXVthXxCnWjOTSqPQAAAVE"]
[Thu Mar 26 19:56:59.094906 2026] [:error] [pid 19710:tid 19724] [client 20.111.48.171:61783] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acUfCwVEWP8Ar68Njk4IFgAAAAI"]
[Thu Mar 26 19:56:59.600970 2026] [:error] [pid 31670:tid 31687] [client 20.111.48.171:61824] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acUfCzXVthXxCnWjOTSqQQAAAU8"]
[Thu Mar 26 19:57:00.105055 2026] [:error] [pid 31670:tid 31678] [client 20.111.48.171:53871] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acUfDDXVthXxCnWjOTSqRAAAAUY"]
[Thu Mar 26 19:57:00.585421 2026] [:error] [pid 31670:tid 31677] [client 20.111.48.171:61853] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fe5.php"] [unique_id "acUfDDXVthXxCnWjOTSqRwAAAUU"]
[Thu Mar 26 19:57:01.113765 2026] [:error] [pid 31780:tid 31842] [client 20.111.48.171:58673] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kj.php"] [unique_id "acUfDZJDwZsy5O4ZXEiu4AAAAhU"]
[Thu Mar 26 19:57:01.605726 2026] [:error] [pid 19818:tid 19842] [client 20.111.48.171:56868] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kj.php"] [unique_id "acUfDczaSnm3d1BeM5UXmgAAANY"]
[Thu Mar 26 19:57:02.087197 2026] [:error] [pid 19818:tid 19824] [client 20.111.48.171:64896] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kj.php"] [unique_id "acUfDszaSnm3d1BeM5UXmwAAAMQ"]
[Thu Mar 26 19:57:02.656116 2026] [:error] [pid 31670:tid 31678] [client 20.111.48.171:55303] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kj.php"] [unique_id "acUfDjXVthXxCnWjOTSqSwAAAUY"]
[Thu Mar 26 19:57:03.191914 2026] [:error] [pid 31670:tid 31677] [client 20.111.48.171:61799] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "acUfDzXVthXxCnWjOTSqTAAAAUU"]
[Thu Mar 26 19:57:03.727846 2026] [:error] [pid 31780:tid 31824] [client 20.111.48.171:62864] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "acUfD5JDwZsy5O4ZXEiu4wAAAgQ"]
[Thu Mar 26 19:57:04.289810 2026] [:error] [pid 19818:tid 19824] [client 20.111.48.171:64946] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "acUfEMzaSnm3d1BeM5UXowAAAMQ"]
[Thu Mar 26 19:57:04.782158 2026] [:error] [pid 31778:tid 31795] [client 20.111.48.171:57184] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/2021/02/index.php"] [unique_id "acUfEA3kybI2o-xasmAMHQAAAcI"]
[Thu Mar 26 19:57:05.437993 2026] [:error] [pid 60829:tid 60833] [client 20.111.48.171:62856] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "acUfEfTdjHKeZokybaTHyQAAAQI"]
[Thu Mar 26 19:57:05.915561 2026] [:error] [pid 31780:tid 31837] [client 20.111.48.171:65065] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "acUfEZJDwZsy5O4ZXEiu5gAAAhA"]
[Thu Mar 26 19:57:06.482038 2026] [:error] [pid 19818:tid 19829] [client 20.111.48.171:60437] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "acUfEszaSnm3d1BeM5UXpwAAAMk"]
[Thu Mar 26 19:57:07.038494 2026] [:error] [pid 31780:tid 31844] [client 20.111.48.171:60397] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "acUfE5JDwZsy5O4ZXEiu6QAAAhc"]
[Thu Mar 26 19:57:07.545279 2026] [:error] [pid 19818:tid 19840] [client 20.111.48.171:61857] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "acUfE8zaSnm3d1BeM5UXqwAAANQ"]
[Thu Mar 26 19:57:08.067376 2026] [:error] [pid 19710:tid 19746] [client 20.111.48.171:61779] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "acUfFAVEWP8Ar68Njk4IGgAAABg"]
[Thu Mar 26 19:57:08.666974 2026] [:error] [pid 31778:tid 31807] [client 20.111.48.171:62821] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "acUfFA3kybI2o-xasmAMJgAAAc4"]
[Thu Mar 26 19:57:09.301054 2026] [:error] [pid 31778:tid 31817] [client 20.111.48.171:60402] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "acUfFQ3kybI2o-xasmAMKAAAAdg"]
[Thu Mar 26 19:57:09.905326 2026] [:error] [pid 19818:tid 19835] [client 20.111.48.171:55521] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "acUfFczaSnm3d1BeM5UXsgAAAM8"]
[Thu Mar 26 19:57:10.546622 2026] [:error] [pid 19711:tid 19758] [client 20.111.48.171:59123] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "acUfFmj3l1y81GYfluSYbQAAAEk"]
[Thu Mar 26 19:57:11.127141 2026] [:error] [pid 19711:tid 19752] [client 20.111.48.171:60384] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "acUfF2j3l1y81GYfluSYbgAAAEM"]
[Thu Mar 26 19:57:11.847906 2026] [:error] [pid 31717:tid 31734] [client 20.111.48.171:64927] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "acUfF7-SCF7YDISDX4_q8gAAAYw"]
[Thu Mar 26 19:57:12.366440 2026] [:error] [pid 19818:tid 19833] [client 20.111.48.171:62837] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fi.php"] [unique_id "acUfGMzaSnm3d1BeM5UXtQAAAM0"]
[Thu Mar 26 19:57:12.919600 2026] [:error] [pid 31780:tid 31837] [client 20.111.48.171:60461] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fi.php"] [unique_id "acUfGJJDwZsy5O4ZXEiu7wAAAhA"]
[Thu Mar 26 19:57:13.567506 2026] [:error] [pid 60829:tid 60836] [client 20.111.48.171:61845] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fi.php"] [unique_id "acUfGfTdjHKeZokybaTHywAAAQU"]
[Thu Mar 26 19:57:14.141921 2026] [:error] [pid 19818:tid 19831] [client 20.111.48.171:60458] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fi.php"] [unique_id "acUfGszaSnm3d1BeM5UXuQAAAMs"]
[Thu Mar 26 19:57:14.622284 2026] [:error] [pid 31670:tid 31689] [client 20.111.48.171:64897] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a1.php"] [unique_id "acUfGjXVthXxCnWjOTSqVwAAAVE"]
[Thu Mar 26 19:57:15.180601 2026] [:error] [pid 31670:tid 31672] [client 20.111.48.171:60434] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a1.php"] [unique_id "acUfGzXVthXxCnWjOTSqWgAAAUA"]
[Thu Mar 26 19:57:15.750881 2026] [:error] [pid 19818:tid 19836] [client 20.111.48.171:60477] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a1.php"] [unique_id "acUfG8zaSnm3d1BeM5UXvAAAANA"]
[Thu Mar 26 19:57:16.325674 2026] [:error] [pid 31670:tid 31679] [client 20.111.48.171:62820] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a1.php"] [unique_id "acUfHDXVthXxCnWjOTSqYQAAAUc"]
[Thu Mar 26 19:57:16.873626 2026] [:error] [pid 31670:tid 31672] [client 20.111.48.171:55509] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/update/f35.php"] [unique_id "acUfHDXVthXxCnWjOTSqZAAAAUA"]
[Thu Mar 26 19:57:17.446282 2026] [:error] [pid 31670:tid 31696] [client 20.111.48.171:62810] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/update/f35.php"] [unique_id "acUfHTXVthXxCnWjOTSqZgAAAVg"]
[Thu Mar 26 19:57:17.927749 2026] [:error] [pid 31670:tid 31686] [client 20.111.48.171:60473] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/update/f35.php"] [unique_id "acUfHTXVthXxCnWjOTSqbAAAAU4"]
[Thu Mar 26 19:57:18.434190 2026] [:error] [pid 31670:tid 31684] [client 20.111.48.171:60435] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/update/f35.php"] [unique_id "acUfHjXVthXxCnWjOTSqbgAAAUw"]
[Thu Mar 26 19:57:18.955356 2026] [:error] [pid 19711:tid 19769] [client 20.111.48.171:61806] [client 20.111.48.171] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "acUfHmj3l1y81GYfluSYcQAAAFQ"]
[Thu Mar 26 19:57:19.453401 2026] [:error] [pid 19818:tid 19825] [client 20.111.48.171:61829] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "acUfH8zaSnm3d1BeM5UXvgAAAMU"]
[Thu Mar 26 19:57:19.986014 2026] [:error] [pid 19818:tid 19837] [client 20.111.48.171:64928] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "acUfH8zaSnm3d1BeM5UXvwAAANE"]
[Thu Mar 26 19:57:20.482926 2026] [:error] [pid 31670:tid 31694] [client 20.111.48.171:61800] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "acUfIDXVthXxCnWjOTSqdQAAAVY"]
[Thu Mar 26 19:57:21.146938 2026] [:error] [pid 31780:tid 31843] [client 20.111.48.171:62836] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "acUfIZJDwZsy5O4ZXEiu9wAAAhY"]
[Thu Mar 26 19:57:21.668838 2026] [:error] [pid 31780:tid 31837] [client 20.111.48.171:62848] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "acUfIZJDwZsy5O4ZXEiu-gAAAhA"]
[Thu Mar 26 19:57:22.193851 2026] [:error] [pid 19818:tid 19828] [client 20.111.48.171:62902] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "acUfIszaSnm3d1BeM5UXyAAAAMg"]
[Thu Mar 26 19:57:22.683390 2026] [:error] [pid 31670:tid 31690] [client 20.111.48.171:55505] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "acUfIjXVthXxCnWjOTSqfgAAAVI"]
[Thu Mar 26 19:57:23.175312 2026] [:error] [pid 31778:tid 31802] [client 20.111.48.171:56888] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "acUfIw3kybI2o-xasmAMNwAAAck"]
[Thu Mar 26 19:57:23.729343 2026] [:error] [pid 31778:tid 31814] [client 20.111.48.171:62903] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "acUfIw3kybI2o-xasmAMOAAAAdU"]
[Thu Mar 26 19:57:24.220070 2026] [:error] [pid 19712:tid 19794] [client 20.111.48.171:55489] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "acUfJNWhKhRNqm23vFMjJgAAAJI"]
[Thu Mar 26 19:57:24.783278 2026] [:error] [pid 19712:tid 19777] [client 20.111.48.171:62818] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "acUfJNWhKhRNqm23vFMjJwAAAIE"]
[Thu Mar 26 19:57:25.264405 2026] [:error] [pid 19818:tid 19843] [client 20.111.48.171:62846] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "acUfJczaSnm3d1BeM5UXzQAAANc"]
[Thu Mar 26 19:57:25.807205 2026] [:error] [pid 31780:tid 31833] [client 20.111.48.171:60360] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/prv8.php"] [unique_id "acUfJZJDwZsy5O4ZXEivAAAAAgw"]
[Thu Mar 26 19:57:26.311421 2026] [:error] [pid 31780:tid 31834] [client 20.111.48.171:61792] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/prv8.php"] [unique_id "acUfJpJDwZsy5O4ZXEivBAAAAg0"]
[Thu Mar 26 19:57:26.814024 2026] [:error] [pid 19818:tid 19825] [client 20.111.48.171:60457] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/prv8.php"] [unique_id "acUfJszaSnm3d1BeM5UXzwAAAMU"]
[Thu Mar 26 19:57:27.300931 2026] [:error] [pid 60829:tid 60855] [client 20.111.48.171:64953] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/prv8.php"] [unique_id "acUfJ_TdjHKeZokybaTH1AAAARg"]
[Thu Mar 26 19:57:27.844968 2026] [:error] [pid 19710:tid 19731] [client 20.111.48.171:62825] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "acUfJwVEWP8Ar68Njk4IHwAAAAk"]
[Thu Mar 26 19:57:28.396323 2026] [:error] [pid 31670:tid 31681] [client 20.111.48.171:61870] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "acUfKDXVthXxCnWjOTSqhQAAAUk"]
[Thu Mar 26 19:57:28.939927 2026] [:error] [pid 31780:tid 31833] [client 20.111.48.171:58625] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "acUfKJJDwZsy5O4ZXEivDAAAAgw"]
[Thu Mar 26 19:57:29.540427 2026] [:error] [pid 60829:tid 60851] [client 20.111.48.171:60415] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "acUfKfTdjHKeZokybaTH2AAAARQ"]
[Thu Mar 26 19:57:30.163872 2026] [:error] [pid 19710:tid 19745] [client 20.111.48.171:61769] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dev.php"] [unique_id "acUfKgVEWP8Ar68Njk4IJQAAABc"]
[Thu Mar 26 19:57:30.748483 2026] [:error] [pid 19710:tid 19736] [client 20.111.48.171:64922] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dev.php"] [unique_id "acUfKgVEWP8Ar68Njk4IJgAAAA4"]
[Thu Mar 26 19:57:31.294811 2026] [:error] [pid 19818:tid 19843] [client 20.111.48.171:57176] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dev.php"] [unique_id "acUfK8zaSnm3d1BeM5UX2gAAANc"]
[Thu Mar 26 19:57:32.178921 2026] [:error] [pid 31780:tid 31832] [client 20.111.48.171:53884] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dev.php"] [unique_id "acUfLJJDwZsy5O4ZXEivGgAAAgs"]
[Thu Mar 26 19:57:32.719427 2026] [:error] [pid 31780:tid 31826] [client 20.111.48.171:64933] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bal.php"] [unique_id "acUfLJJDwZsy5O4ZXEivHwAAAgY"]
[Thu Mar 26 19:57:33.196646 2026] [:error] [pid 31780:tid 31830] [client 20.111.48.171:61774] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bal.php"] [unique_id "acUfLZJDwZsy5O4ZXEivIQAAAgk"]
[Thu Mar 26 19:57:33.703845 2026] [:error] [pid 31670:tid 31694] [client 20.111.48.171:58639] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bal.php"] [unique_id "acUfLTXVthXxCnWjOTSqkAAAAVY"]
[Thu Mar 26 19:57:34.190935 2026] [:error] [pid 31670:tid 31682] [client 20.111.48.171:61851] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bal.php"] [unique_id "acUfLjXVthXxCnWjOTSqkwAAAUo"]
[Thu Mar 26 19:57:34.701773 2026] [:error] [pid 31670:tid 31684] [client 20.111.48.171:61880] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/in.php"] [unique_id "acUfLjXVthXxCnWjOTSqlAAAAUw"]
[Thu Mar 26 19:57:35.242984 2026] [:error] [pid 31670:tid 31683] [client 20.111.48.171:59120] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/in.php"] [unique_id "acUfLzXVthXxCnWjOTSqlgAAAUs"]
[Thu Mar 26 19:57:35.799688 2026] [:error] [pid 31670:tid 31690] [client 20.111.48.171:58666] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/in.php"] [unique_id "acUfLzXVthXxCnWjOTSqmgAAAVI"]
[Thu Mar 26 19:57:36.292912 2026] [:error] [pid 31780:tid 31822] [client 20.111.48.171:61850] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/in.php"] [unique_id "acUfMJJDwZsy5O4ZXEivJwAAAgI"]
[Thu Mar 26 19:57:36.806490 2026] [:error] [pid 31670:tid 31686] [client 20.111.48.171:62850] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gssdd.php"] [unique_id "acUfMDXVthXxCnWjOTSqogAAAU4"]
[Thu Mar 26 19:57:37.333114 2026] [:error] [pid 31670:tid 31687] [client 20.111.48.171:62792] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gssdd.php"] [unique_id "acUfMTXVthXxCnWjOTSqpQAAAU8"]
[Thu Mar 26 19:57:37.832343 2026] [:error] [pid 31670:tid 31691] [client 20.111.48.171:53851] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gssdd.php"] [unique_id "acUfMTXVthXxCnWjOTSqqAAAAVM"]
[Thu Mar 26 19:57:38.323437 2026] [:error] [pid 31717:tid 31735] [client 20.111.48.171:65060] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gssdd.php"] [unique_id "acUfMr-SCF7YDISDX4_q9gAAAY0"]
[Thu Mar 26 19:57:38.797262 2026] [:error] [pid 19710:tid 19739] [client 20.111.48.171:60470] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "acUfMgVEWP8Ar68Njk4IKgAAABE"]
[Thu Mar 26 19:57:39.398698 2026] [:error] [pid 31670:tid 31676] [client 20.111.48.171:60467] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "acUfMzXVthXxCnWjOTSqrwAAAUQ"]
[Thu Mar 26 19:57:39.935967 2026] [:error] [pid 19710:tid 19734] [client 20.111.48.171:64915] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "acUfMwVEWP8Ar68Njk4ILgAAAAw"]
[Thu Mar 26 19:57:40.431451 2026] [:error] [pid 31717:tid 31746] [client 20.111.48.171:59101] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "acUfNL-SCF7YDISDX4_q-AAAAZg"]
[Thu Mar 26 19:57:40.937025 2026] [:error] [pid 31717:tid 31731] [client 20.111.48.171:62869] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bs1.php"] [unique_id "acUfNL-SCF7YDISDX4_q-gAAAYk"]
[Thu Mar 26 19:57:41.451814 2026] [:error] [pid 19710:tid 19744] [client 20.111.48.171:60390] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bs1.php"] [unique_id "acUfNQVEWP8Ar68Njk4IMQAAABY"]
[Thu Mar 26 19:57:42.119638 2026] [:error] [pid 31717:tid 31733] [client 20.111.48.171:55547] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bs1.php"] [unique_id "acUfNr-SCF7YDISDX4_q_QAAAYs"]
[Thu Mar 26 19:57:42.666355 2026] [:error] [pid 19818:tid 19844] [client 20.111.48.171:64911] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bs1.php"] [unique_id "acUfNszaSnm3d1BeM5UX4AAAANg"]
[Thu Mar 26 19:57:43.151106 2026] [:error] [pid 31670:tid 31682] [client 20.111.48.171:55495] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bengi.php"] [unique_id "acUfNzXVthXxCnWjOTSqtAAAAUo"]
[Thu Mar 26 19:57:43.624182 2026] [:error] [pid 31778:tid 31800] [client 20.111.48.171:61821] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bengi.php"] [unique_id "acUfNw3kybI2o-xasmAMRQAAAcc"]
[Thu Mar 26 19:57:44.191846 2026] [:error] [pid 31780:tid 31838] [client 20.111.48.171:61872] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bengi.php"] [unique_id "acUfOJJDwZsy5O4ZXEivLwAAAhE"]
[Thu Mar 26 19:57:45.303850 2026] [:error] [pid 31670:tid 31692] [client 20.111.48.171:62786] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bengi.php"] [unique_id "acUfOTXVthXxCnWjOTSqtgAAAVQ"]
[Thu Mar 26 19:57:45.840764 2026] [:error] [pid 31670:tid 31681] [client 20.111.48.171:55345] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acUfOTXVthXxCnWjOTSqugAAAUk"]
[Thu Mar 26 19:57:46.357302 2026] [:error] [pid 31670:tid 31676] [client 20.111.48.171:62834] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acUfOjXVthXxCnWjOTSqvAAAAUQ"]
[Thu Mar 26 19:57:46.880870 2026] [:error] [pid 31780:tid 31842] [client 20.111.48.171:60380] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acUfOpJDwZsy5O4ZXEivMAAAAhU"]
[Thu Mar 26 19:57:47.363102 2026] [:error] [pid 31670:tid 31686] [client 20.111.48.171:60479] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "acUfOzXVthXxCnWjOTSqvwAAAU4"]
[Thu Mar 26 19:57:47.849844 2026] [:error] [pid 31780:tid 31821] [client 20.111.48.171:61796] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/axx.php"] [unique_id "acUfO5JDwZsy5O4ZXEivMQAAAgE"]
[Thu Mar 26 19:57:48.332026 2026] [:error] [pid 31717:tid 31746] [client 20.111.48.171:60363] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/axx.php"] [unique_id "acUfPL-SCF7YDISDX4_rBAAAAZg"]
[Thu Mar 26 19:57:48.856785 2026] [:error] [pid 19712:tid 19782] [client 20.111.48.171:60385] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/axx.php"] [unique_id "acUfPNWhKhRNqm23vFMjLgAAAIY"]
[Thu Mar 26 19:57:49.371758 2026] [:error] [pid 31670:tid 31673] [client 20.111.48.171:59091] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/axx.php"] [unique_id "acUfPTXVthXxCnWjOTSqyAAAAUE"]
[Thu Mar 26 19:57:49.935017 2026] [:error] [pid 31670:tid 31696] [client 20.111.48.171:56866] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alfashell.php"] [unique_id "acUfPTXVthXxCnWjOTSqygAAAVg"]
[Thu Mar 26 19:57:50.469960 2026] [:error] [pid 31717:tid 31727] [client 20.111.48.171:62887] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alfashell.php"] [unique_id "acUfPr-SCF7YDISDX4_rCgAAAYU"]
[Thu Mar 26 19:57:51.019089 2026] [:error] [pid 19818:tid 19838] [client 20.111.48.171:55549] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alfashell.php"] [unique_id "acUfP8zaSnm3d1BeM5UX5gAAANI"]
[Thu Mar 26 19:57:51.537922 2026] [:error] [pid 31670:tid 31679] [client 20.111.48.171:62834] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alfashell.php"] [unique_id "acUfPzXVthXxCnWjOTSq1AAAAUc"]
[Thu Mar 26 19:57:52.037193 2026] [:error] [pid 31670:tid 31674] [client 20.111.48.171:62839] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "acUfQDXVthXxCnWjOTSq3QAAAUI"]
[Thu Mar 26 19:57:52.512193 2026] [:error] [pid 19818:tid 19826] [client 20.111.48.171:61762] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "acUfQMzaSnm3d1BeM5UX5wAAAMY"]
[Thu Mar 26 19:58:12.303797 2026] [:error] [pid 19818:tid 19832] [client 20.111.48.171:58643] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ew.php"] [unique_id "acUfVMzaSnm3d1BeM5UYHQAAAMw"]
[Thu Mar 26 19:58:12.846392 2026] [:error] [pid 19712:tid 19786] [client 20.111.48.171:55315] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ew.php"] [unique_id "acUfVNWhKhRNqm23vFMjMAAAAIo"]
[Thu Mar 26 19:58:13.479678 2026] [:error] [pid 60829:tid 60836] [client 20.111.48.171:58653] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ew.php"] [unique_id "acUfVfTdjHKeZokybaTIAAAAAQU"]
[Thu Mar 26 19:58:13.963333 2026] [:error] [pid 19710:tid 19725] [client 20.111.48.171:57178] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ew.php"] [unique_id "acUfVQVEWP8Ar68Njk4IQgAAAAM"]
[Thu Mar 26 19:58:14.523463 2026] [:error] [pid 31670:tid 31675] [client 20.111.48.171:61879] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css.php"] [unique_id "acUfVjXVthXxCnWjOTSrKwAAAUM"]
[Thu Mar 26 19:58:15.055342 2026] [:error] [pid 31778:tid 31803] [client 20.111.48.171:64945] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css.php"] [unique_id "acUfVw3kybI2o-xasmAMYQAAAco"]
[Thu Mar 26 19:58:15.612440 2026] [:error] [pid 31778:tid 31814] [client 20.111.48.171:58649] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css.php"] [unique_id "acUfVw3kybI2o-xasmAMYwAAAdU"]
[Thu Mar 26 19:58:16.135118 2026] [:error] [pid 31780:tid 31838] [client 20.111.48.171:58681] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css.php"] [unique_id "acUfWJJDwZsy5O4ZXEivXwAAAhE"]
[Thu Mar 26 19:58:16.651745 2026] [:error] [pid 31670:tid 31693] [client 20.111.48.171:64916] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goat1.php"] [unique_id "acUfWDXVthXxCnWjOTSrMwAAAVU"]
[Thu Mar 26 19:58:17.299981 2026] [:error] [pid 31670:tid 31694] [client 20.111.48.171:64955] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goat1.php"] [unique_id "acUfWTXVthXxCnWjOTSrNwAAAVY"]
[Thu Mar 26 19:58:17.837894 2026] [:error] [pid 19711:tid 19767] [client 20.111.48.171:65085] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goat1.php"] [unique_id "acUfWWj3l1y81GYfluSYjgAAAFI"]
[Thu Mar 26 19:58:18.371777 2026] [:error] [pid 19818:tid 19834] [client 20.111.48.171:60403] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/goat1.php"] [unique_id "acUfWszaSnm3d1BeM5UYHwAAAM4"]
[Thu Mar 26 19:58:19.064724 2026] [:error] [pid 19818:tid 19831] [client 20.111.48.171:64914] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file21.php"] [unique_id "acUfW8zaSnm3d1BeM5UYIQAAAMs"]
[Thu Mar 26 19:58:19.586049 2026] [:error] [pid 31717:tid 31744] [client 20.111.48.171:60373] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file21.php"] [unique_id "acUfW7-SCF7YDISDX4_rKQAAAZY"]
[Thu Mar 26 19:58:20.118415 2026] [:error] [pid 60829:tid 60831] [client 20.111.48.171:60468] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file21.php"] [unique_id "acUfXPTdjHKeZokybaTIBAAAAQA"]
[Thu Mar 26 19:58:20.643502 2026] [:error] [pid 60829:tid 60832] [client 20.111.48.171:61772] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file21.php"] [unique_id "acUfXPTdjHKeZokybaTIBgAAAQE"]
[Thu Mar 26 19:58:21.140019 2026] [:error] [pid 19818:tid 19841] [client 20.111.48.171:64954] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class19.php"] [unique_id "acUfXczaSnm3d1BeM5UYJwAAANU"]
[Thu Mar 26 19:58:21.645492 2026] [:error] [pid 31778:tid 31814] [client 20.111.48.171:61786] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class19.php"] [unique_id "acUfXQ3kybI2o-xasmAMbwAAAdU"]
[Thu Mar 26 19:58:22.194777 2026] [:error] [pid 19711:tid 19762] [client 20.111.48.171:61777] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class19.php"] [unique_id "acUfXmj3l1y81GYfluSYkQAAAE0"]
[Thu Mar 26 19:58:22.704963 2026] [:error] [pid 60829:tid 60841] [client 20.111.48.171:59129] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class19.php"] [unique_id "acUfXvTdjHKeZokybaTICQAAAQo"]
[Thu Mar 26 19:58:23.253779 2026] [:error] [pid 31778:tid 31801] [client 20.111.48.171:61826] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fffff.php"] [unique_id "acUfXw3kybI2o-xasmAMcgAAAcg"]
[Thu Mar 26 19:58:23.764334 2026] [:error] [pid 31670:tid 31695] [client 20.111.48.171:60476] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fffff.php"] [unique_id "acUfXzXVthXxCnWjOTSrRAAAAVc"]
[Thu Mar 26 19:58:24.264559 2026] [:error] [pid 31670:tid 31678] [client 20.111.48.171:61791] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fffff.php"] [unique_id "acUfYDXVthXxCnWjOTSrRwAAAUY"]
[Thu Mar 26 19:58:24.800509 2026] [:error] [pid 19818:tid 19828] [client 20.111.48.171:60367] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fffff.php"] [unique_id "acUfYMzaSnm3d1BeM5UYKwAAAMg"]
[Thu Mar 26 19:58:25.361322 2026] [:error] [pid 19818:tid 19830] [client 20.111.48.171:61804] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/thh.php"] [unique_id "acUfYczaSnm3d1BeM5UYLAAAAMo"]
[Thu Mar 26 19:58:25.874197 2026] [:error] [pid 19818:tid 19825] [client 20.111.48.171:60478] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/thh.php"] [unique_id "acUfYczaSnm3d1BeM5UYLgAAAMU"]
[Thu Mar 26 19:58:26.458001 2026] [:error] [pid 31780:tid 31831] [client 20.111.48.171:56836] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/thh.php"] [unique_id "acUfYpJDwZsy5O4ZXEivYQAAAgo"]
[Thu Mar 26 19:58:27.001163 2026] [:error] [pid 31780:tid 31833] [client 20.111.48.171:53716] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/thh.php"] [unique_id "acUfY5JDwZsy5O4ZXEivYwAAAgw"]
[Thu Mar 26 19:58:27.585835 2026] [:error] [pid 19818:tid 19824] [client 20.111.48.171:58675] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/yellow.php"] [unique_id "acUfY8zaSnm3d1BeM5UYNAAAAMQ"]
[Thu Mar 26 19:58:28.100841 2026] [:error] [pid 19818:tid 19825] [client 20.111.48.171:62891] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/yellow.php"] [unique_id "acUfZMzaSnm3d1BeM5UYNgAAAMU"]
[Thu Mar 26 19:58:28.751875 2026] [:error] [pid 19818:tid 19837] [client 20.111.48.171:60421] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/yellow.php"] [unique_id "acUfZMzaSnm3d1BeM5UYPgAAANE"]
[Thu Mar 26 19:58:29.299310 2026] [:error] [pid 31778:tid 31794] [client 20.111.48.171:59085] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/yellow.php"] [unique_id "acUfZQ3kybI2o-xasmAMdwAAAcE"]
[Thu Mar 26 19:58:29.802377 2026] [:error] [pid 19712:tid 19791] [client 20.111.48.171:62891] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wfile.php"] [unique_id "acUfZdWhKhRNqm23vFMjNwAAAI8"]
[Thu Mar 26 19:58:30.305621 2026] [:error] [pid 19712:tid 19779] [client 20.111.48.171:53756] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wfile.php"] [unique_id "acUfZtWhKhRNqm23vFMjOAAAAIM"]
[Thu Mar 26 19:58:31.000218 2026] [:error] [pid 19818:tid 19841] [client 20.111.48.171:60406] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wfile.php"] [unique_id "acUfZszaSnm3d1BeM5UYSAAAANU"]
[Thu Mar 26 19:58:31.771279 2026] [:error] [pid 19818:tid 19830] [client 20.111.48.171:59102] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wfile.php"] [unique_id "acUfZ8zaSnm3d1BeM5UYTQAAAMo"]
[Thu Mar 26 19:58:32.310715 2026] [:error] [pid 31780:tid 31839] [client 20.111.48.171:55525] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class20.php"] [unique_id "acUfaJJDwZsy5O4ZXEivbAAAAhI"]
[Thu Mar 26 19:58:32.839576 2026] [:error] [pid 19818:tid 19835] [client 20.111.48.171:65085] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class20.php"] [unique_id "acUfaMzaSnm3d1BeM5UYUwAAAM8"]
[Thu Mar 26 19:58:33.837616 2026] [:error] [pid 31780:tid 31832] [client 20.111.48.171:61771] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class20.php"] [unique_id "acUfaZJDwZsy5O4ZXEivbwAAAgs"]
[Thu Mar 26 19:58:34.419973 2026] [:error] [pid 19710:tid 19743] [client 20.111.48.171:61766] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class20.php"] [unique_id "acUfagVEWP8Ar68Njk4ISgAAABU"]
[Thu Mar 26 19:58:34.904788 2026] [:error] [pid 31717:tid 31732] [client 20.111.48.171:55506] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/build.php"] [unique_id "acUfar-SCF7YDISDX4_rMAAAAYo"]
[Thu Mar 26 19:58:35.439675 2026] [:error] [pid 31717:tid 31728] [client 20.111.48.171:62906] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/build.php"] [unique_id "acUfa7-SCF7YDISDX4_rMgAAAYY"]
[Thu Mar 26 19:58:35.917589 2026] [:error] [pid 31717:tid 31735] [client 20.111.48.171:59099] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/build.php"] [unique_id "acUfa7-SCF7YDISDX4_rNQAAAY0"]
[Thu Mar 26 19:58:36.455080 2026] [:error] [pid 31780:tid 31834] [client 20.111.48.171:55326] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/build.php"] [unique_id "acUfbJJDwZsy5O4ZXEivcQAAAg0"]
[Thu Mar 26 19:58:36.991151 2026] [:error] [pid 31780:tid 31843] [client 20.111.48.171:59090] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file1.php"] [unique_id "acUfbJJDwZsy5O4ZXEivcwAAAhY"]
[Thu Mar 26 19:58:37.520546 2026] [:error] [pid 31780:tid 31842] [client 20.111.48.171:59113] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file1.php"] [unique_id "acUfbZJDwZsy5O4ZXEivdwAAAhU"]
[Thu Mar 26 19:58:38.007944 2026] [:error] [pid 19710:tid 19723] [client 20.111.48.171:61854] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file1.php"] [unique_id "acUfbgVEWP8Ar68Njk4ITgAAAAE"]
[Thu Mar 26 19:58:38.606996 2026] [:error] [pid 31717:tid 31738] [client 20.111.48.171:56876] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file1.php"] [unique_id "acUfbr-SCF7YDISDX4_rOgAAAZA"]
[Thu Mar 26 19:58:39.102746 2026] [:error] [pid 31717:tid 31732] [client 20.111.48.171:62849] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/520.php"] [unique_id "acUfb7-SCF7YDISDX4_rQQAAAYo"]
[Thu Mar 26 19:58:39.599572 2026] [:error] [pid 31780:tid 31830] [client 20.111.48.171:62866] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/520.php"] [unique_id "acUfb5JDwZsy5O4ZXEivfgAAAgk"]
[Thu Mar 26 19:58:40.167560 2026] [:error] [pid 60829:tid 60841] [client 20.111.48.171:60433] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/520.php"] [unique_id "acUfcPTdjHKeZokybaTIEgAAAQo"]
[Thu Mar 26 19:58:40.657959 2026] [:error] [pid 31780:tid 31839] [client 20.111.48.171:61828] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/520.php"] [unique_id "acUfcJJDwZsy5O4ZXEivhAAAAhI"]
[Thu Mar 26 19:58:41.137889 2026] [:error] [pid 31670:tid 31675] [client 20.111.48.171:60462] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file18.php"] [unique_id "acUfcTXVthXxCnWjOTSrUAAAAUM"]
[Thu Mar 26 19:58:41.624378 2026] [:error] [pid 60829:tid 60849] [client 20.111.48.171:57210] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file18.php"] [unique_id "acUfcfTdjHKeZokybaTIFAAAARI"]
[Thu Mar 26 19:58:42.124213 2026] [:error] [pid 31778:tid 31799] [client 20.111.48.171:61868] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file18.php"] [unique_id "acUfcg3kybI2o-xasmAMfAAAAcY"]
[Thu Mar 26 19:58:42.630895 2026] [:error] [pid 31780:tid 31841] [client 20.111.48.171:64917] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file18.php"] [unique_id "acUfcpJDwZsy5O4ZXEivhQAAAhQ"]
[Thu Mar 26 19:58:43.122592 2026] [:error] [pid 31778:tid 31802] [client 20.111.48.171:58646] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ffile.php"] [unique_id "acUfcw3kybI2o-xasmAMgAAAAck"]
[Thu Mar 26 19:58:43.638280 2026] [:error] [pid 31780:tid 31826] [client 20.111.48.171:65070] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ffile.php"] [unique_id "acUfc5JDwZsy5O4ZXEiviAAAAgY"]
[Thu Mar 26 19:58:44.136191 2026] [:error] [pid 60829:tid 60831] [client 20.111.48.171:60455] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ffile.php"] [unique_id "acUfdPTdjHKeZokybaTIGQAAAQA"]
[Thu Mar 26 19:58:44.609373 2026] [:error] [pid 60829:tid 60855] [client 20.111.48.171:62838] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ffile.php"] [unique_id "acUfdPTdjHKeZokybaTIGwAAARg"]
[Thu Mar 26 19:58:45.122989 2026] [:error] [pid 19818:tid 19841] [client 20.111.48.171:64939] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vee.php"] [unique_id "acUfdczaSnm3d1BeM5UYVgAAANU"]
[Thu Mar 26 19:58:45.618841 2026] [:error] [pid 60829:tid 60845] [client 20.111.48.171:60475] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vee.php"] [unique_id "acUfdfTdjHKeZokybaTIHwAAAQ4"]
[Thu Mar 26 19:58:46.297060 2026] [:error] [pid 19712:tid 19797] [client 20.111.48.171:55528] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vee.php"] [unique_id "acUfdtWhKhRNqm23vFMjPAAAAJU"]
[Thu Mar 26 19:58:46.777851 2026] [:error] [pid 19710:tid 19727] [client 20.111.48.171:59075] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vee.php"] [unique_id "acUfdgVEWP8Ar68Njk4IUQAAAAU"]
[Thu Mar 26 19:58:47.327326 2026] [:error] [pid 60829:tid 60834] [client 20.111.48.171:64910] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/efile.php"] [unique_id "acUfd_TdjHKeZokybaTIIgAAAQM"]
[Thu Mar 26 19:58:47.857767 2026] [:error] [pid 19710:tid 19737] [client 20.111.48.171:59106] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/efile.php"] [unique_id "acUfdwVEWP8Ar68Njk4IUgAAAA8"]
[Thu Mar 26 19:58:48.354078 2026] [:error] [pid 31778:tid 31816] [client 20.111.48.171:57202] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/efile.php"] [unique_id "acUfeA3kybI2o-xasmAMiAAAAdc"]
[Thu Mar 26 19:58:48.845867 2026] [:error] [pid 31778:tid 31796] [client 20.111.48.171:65066] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/efile.php"] [unique_id "acUfeA3kybI2o-xasmAMiQAAAcM"]
[Thu Mar 26 19:58:49.353169 2026] [:error] [pid 19712:tid 19784] [client 20.111.48.171:61788] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/afile.php"] [unique_id "acUfedWhKhRNqm23vFMjQQAAAIg"]
[Thu Mar 26 19:58:49.854309 2026] [:error] [pid 31670:tid 31695] [client 20.111.48.171:60464] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/afile.php"] [unique_id "acUfeTXVthXxCnWjOTSrVQAAAVc"]
[Thu Mar 26 19:58:50.351861 2026] [:error] [pid 31670:tid 31675] [client 20.111.48.171:53301] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/afile.php"] [unique_id "acUfejXVthXxCnWjOTSrWgAAAUM"]
[Thu Mar 26 19:58:50.881481 2026] [:error] [pid 19818:tid 19830] [client 20.111.48.171:62805] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/afile.php"] [unique_id "acUfeszaSnm3d1BeM5UYWwAAAMo"]
[Thu Mar 26 19:58:51.365606 2026] [:error] [pid 31778:tid 31813] [client 20.111.48.171:61864] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lites.php"] [unique_id "acUfew3kybI2o-xasmAMjAAAAdQ"]
[Thu Mar 26 19:58:51.946506 2026] [:error] [pid 19818:tid 19831] [client 20.111.48.171:60423] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lites.php"] [unique_id "acUfe8zaSnm3d1BeM5UYYQAAAMs"]
[Thu Mar 26 19:58:52.456998 2026] [:error] [pid 60829:tid 60853] [client 20.111.48.171:58672] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lites.php"] [unique_id "acUffPTdjHKeZokybaTIJgAAARY"]
[Thu Mar 26 19:58:52.994275 2026] [:error] [pid 31717:tid 31729] [client 20.111.48.171:56885] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lites.php"] [unique_id "acUffL-SCF7YDISDX4_rSgAAAYc"]
[Thu Mar 26 19:58:53.574583 2026] [:error] [pid 19710:tid 19731] [client 20.111.48.171:62859] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/0x.php"] [unique_id "acUffQVEWP8Ar68Njk4IVQAAAAk"]
[Thu Mar 26 19:58:54.099022 2026] [:error] [pid 19818:tid 19826] [client 20.111.48.171:60371] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/0x.php"] [unique_id "acUffszaSnm3d1BeM5UYaAAAAMY"]
[Thu Mar 26 19:58:54.597724 2026] [:error] [pid 19818:tid 19834] [client 20.111.48.171:53838] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/0x.php"] [unique_id "acUffszaSnm3d1BeM5UYaQAAAM4"]
[Thu Mar 26 19:58:55.172737 2026] [:error] [pid 19818:tid 19832] [client 20.111.48.171:55491] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/0x.php"] [unique_id "acUff8zaSnm3d1BeM5UYawAAAMw"]
[Thu Mar 26 19:58:55.728177 2026] [:error] [pid 19818:tid 19839] [client 20.111.48.171:60474] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless3.php"] [unique_id "acUff8zaSnm3d1BeM5UYbgAAANM"]
[Thu Mar 26 19:58:56.894111 2026] [:error] [pid 19710:tid 19732] [client 20.111.48.171:60458] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless3.php"] [unique_id "acUfgAVEWP8Ar68Njk4IVwAAAAo"]
[Thu Mar 26 19:58:57.413023 2026] [:error] [pid 19710:tid 19734] [client 20.111.48.171:60408] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless3.php"] [unique_id "acUfgQVEWP8Ar68Njk4IWQAAAAw"]
[Thu Mar 26 19:58:57.990780 2026] [:error] [pid 60829:tid 60836] [client 20.111.48.171:53813] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless3.php"] [unique_id "acUfgfTdjHKeZokybaTIKwAAAQU"]
[Thu Mar 26 19:58:58.479898 2026] [:error] [pid 31670:tid 31681] [client 20.111.48.171:59100] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/enclas.php"] [unique_id "acUfgjXVthXxCnWjOTSrXwAAAUk"]
[Thu Mar 26 19:58:58.966852 2026] [:error] [pid 31670:tid 31686] [client 20.111.48.171:60471] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/enclas.php"] [unique_id "acUfgjXVthXxCnWjOTSrYQAAAU4"]
[Thu Mar 26 19:58:59.530211 2026] [:error] [pid 31670:tid 31696] [client 20.111.48.171:60360] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/enclas.php"] [unique_id "acUfgzXVthXxCnWjOTSrZAAAAVg"]
[Thu Mar 26 19:59:00.086344 2026] [:error] [pid 19818:tid 19838] [client 20.111.48.171:62785] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/enclas.php"] [unique_id "acUfhMzaSnm3d1BeM5UYeQAAANI"]
[Thu Mar 26 19:59:00.695849 2026] [:error] [pid 19818:tid 19829] [client 20.111.48.171:59092] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/he.php"] [unique_id "acUfhMzaSnm3d1BeM5UYegAAAMk"]
[Thu Mar 26 19:59:01.181366 2026] [:error] [pid 19712:tid 19789] [client 20.111.48.171:65026] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/he.php"] [unique_id "acUfhdWhKhRNqm23vFMjRQAAAI0"]
[Thu Mar 26 19:59:01.701292 2026] [:error] [pid 19712:tid 19787] [client 20.111.48.171:55509] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/he.php"] [unique_id "acUfhdWhKhRNqm23vFMjRgAAAIs"]
[Thu Mar 26 19:59:02.206568 2026] [:error] [pid 19712:tid 19778] [client 20.111.48.171:62910] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/he.php"] [unique_id "acUfhtWhKhRNqm23vFMjSAAAAII"]
[Thu Mar 26 19:59:02.689754 2026] [:error] [pid 31670:tid 31686] [client 20.111.48.171:59089] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aves.php"] [unique_id "acUfhjXVthXxCnWjOTSrcAAAAU4"]
[Thu Mar 26 19:59:03.183054 2026] [:error] [pid 19818:tid 19840] [client 20.111.48.171:65028] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aves.php"] [unique_id "acUfh8zaSnm3d1BeM5UYfQAAANQ"]
[Thu Mar 26 19:59:03.693320 2026] [:error] [pid 31717:tid 31736] [client 20.111.48.171:60382] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aves.php"] [unique_id "acUfh7-SCF7YDISDX4_rVQAAAY4"]
[Thu Mar 26 19:59:04.244062 2026] [:error] [pid 31717:tid 31731] [client 20.111.48.171:56895] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aves.php"] [unique_id "acUfiL-SCF7YDISDX4_rVgAAAYk"]
[Thu Mar 26 19:59:04.762308 2026] [:error] [pid 31670:tid 31693] [client 20.111.48.171:60400] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cabs.php"] [unique_id "acUfiDXVthXxCnWjOTSrdQAAAVU"]
[Thu Mar 26 19:59:05.243871 2026] [:error] [pid 31670:tid 31673] [client 20.111.48.171:64938] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cabs.php"] [unique_id "acUfiTXVthXxCnWjOTSrdgAAAUE"]
[Thu Mar 26 19:59:05.763727 2026] [:error] [pid 31670:tid 31684] [client 20.111.48.171:57156] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cabs.php"] [unique_id "acUfiTXVthXxCnWjOTSreQAAAUw"]
[Thu Mar 26 19:59:06.353349 2026] [:error] [pid 31778:tid 31804] [client 20.111.48.171:55532] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cabs.php"] [unique_id "acUfig3kybI2o-xasmAMkAAAAcs"]
[Thu Mar 26 19:59:06.924165 2026] [:error] [pid 19712:tid 19778] [client 20.111.48.171:53832] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file88.php"] [unique_id "acUfitWhKhRNqm23vFMjUwAAAII"]
[Thu Mar 26 19:59:07.461018 2026] [:error] [pid 31717:tid 31735] [client 20.111.48.171:60374] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file88.php"] [unique_id "acUfi7-SCF7YDISDX4_rWwAAAY0"]
[Thu Mar 26 19:59:08.063521 2026] [:error] [pid 60829:tid 60831] [client 20.111.48.171:60463] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file88.php"] [unique_id "acUfjPTdjHKeZokybaTILgAAAQA"]
[Thu Mar 26 19:59:08.722274 2026] [:error] [pid 31780:tid 31842] [client 20.111.48.171:61858] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file88.php"] [unique_id "acUfjJJDwZsy5O4ZXEivmwAAAhU"]
[Thu Mar 26 19:59:09.280973 2026] [:error] [pid 31670:tid 31696] [client 20.111.48.171:60357] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xwx1.php"] [unique_id "acUfjTXVthXxCnWjOTSrhAAAAVg"]
[Thu Mar 26 19:59:09.869265 2026] [:error] [pid 31670:tid 31688] [client 20.111.48.171:58682] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xwx1.php"] [unique_id "acUfjTXVthXxCnWjOTSrhwAAAVA"]
[Thu Mar 26 19:59:10.359015 2026] [:error] [pid 60829:tid 60855] [client 20.111.48.171:56891] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xwx1.php"] [unique_id "acUfjvTdjHKeZokybaTIMAAAARg"]
[Thu Mar 26 19:59:10.852460 2026] [:error] [pid 19711:tid 19759] [client 20.111.48.171:61867] [client 20.111.48.171] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xwx1.php"] [unique_id "acUfjmj3l1y81GYfluSYqAAAAEo"]
[Thu Mar 26 20:34:29.839024 2026] [:error] [pid 31778:tid 31798] [client 45.116.113.98:61409] [client 45.116.113.98] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.116.113.98, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acUn1Q3kybI2o-xasmAUtQAAAcU"]
[Thu Mar 26 20:34:30.339435 2026] [:error] [pid 31780:tid 31833] [client 103.126.229.87:61382] [client 103.126.229.87] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.126.229.87, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acUn1pJDwZsy5O4ZXEi5BQAAAgw"]
[Thu Mar 26 21:59:44.012520 2026] [:error] [pid 19710:tid 19735] [client 20.104.216.159:36765] [client 20.104.216.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.104.216.159, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acU70AVEWP8Ar68Njk4oTgAAAA0"]
[Thu Mar 26 21:59:47.268929 2026] [:error] [pid 19710:tid 19728] [client 20.104.216.159:36765] [client 20.104.216.159] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.104.216.159, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acU70wVEWP8Ar68Njk4oVwAAAAY"]
[Thu Mar 26 21:59:50.432716 2026] [:error] [pid 19710:tid 19722] [client 20.104.216.159:36765] [client 20.104.216.159] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "acU71gVEWP8Ar68Njk4oZgAAAAA"]
[Fri Mar 27 01:38:07.459436 2026] [:error] [pid 62551:tid 62575] [client 185.169.4.152:53127] [client 185.169.4.152] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "acVu_4QvFHgfE1g4p7CRQwAAAdU"]
[Fri Mar 27 01:38:08.177855 2026] [:error] [pid 62551:tid 62569] [client 185.169.4.152:63765] [client 185.169.4.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.vscode/sftp.json"] [unique_id "acVvAIQvFHgfE1g4p7CRRQAAAc8"]
[Fri Mar 27 03:26:45.135417 2026] [:error] [pid 62149:tid 62546] [client 20.215.248.112:58061] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acWIdWHvvta9MPqU8PWETwAAARY"]
[Fri Mar 27 03:26:45.797208 2026] [:error] [pid 62147:tid 62482] [client 20.215.248.112:39806] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acWIdRPjxn06mcLazN6ypgAAABY"]
[Fri Mar 27 03:26:46.533285 2026] [:error] [pid 44058:tid 44064] [client 20.215.248.112:20625] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acWIduqp9u5CVRGdZPFMJwAAAIQ"]
[Fri Mar 27 03:26:47.503777 2026] [:error] [pid 62149:tid 62535] [client 20.215.248.112:21296] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aa.php"] [unique_id "acWId2Hvvta9MPqU8PWEUAAAAQs"]
[Fri Mar 27 03:26:48.363281 2026] [:error] [pid 44058:tid 44066] [client 20.215.248.112:47331] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-cxs.php"] [unique_id "acWIeOqp9u5CVRGdZPFMLwAAAIY"]
[Fri Mar 27 03:26:48.971028 2026] [:error] [pid 62149:tid 62538] [client 20.215.248.112:32740] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-cxs.php"] [unique_id "acWIeGHvvta9MPqU8PWEVAAAAQ4"]
[Fri Mar 27 03:26:49.855720 2026] [:error] [pid 62147:tid 62472] [client 20.215.248.112:20196] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-cxs.php"] [unique_id "acWIeRPjxn06mcLazN6ysQAAAAw"]
[Fri Mar 27 03:26:50.507042 2026] [:error] [pid 62147:tid 62479] [client 20.215.248.112:47356] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-cxs.php"] [unique_id "acWIehPjxn06mcLazN6ytAAAABM"]
[Fri Mar 27 03:26:51.186903 2026] [:error] [pid 62149:tid 62547] [client 20.215.248.112:35852] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-scanner.php"] [unique_id "acWIe2Hvvta9MPqU8PWEWAAAARc"]
[Fri Mar 27 03:26:51.810222 2026] [:error] [pid 62149:tid 62524] [client 20.215.248.112:39761] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-scanner.php"] [unique_id "acWIe2Hvvta9MPqU8PWEWQAAAQA"]
[Fri Mar 27 03:26:52.540753 2026] [:error] [pid 62147:tid 62472] [client 20.215.248.112:20648] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-scanner.php"] [unique_id "acWIfBPjxn06mcLazN6yvAAAAAw"]
[Fri Mar 27 03:26:53.331530 2026] [:error] [pid 62551:tid 62577] [client 20.215.248.112:20168] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-scanner.php"] [unique_id "acWIfYQvFHgfE1g4p7C4HQAAAdc"]
[Fri Mar 27 03:26:53.987510 2026] [:error] [pid 62149:tid 62528] [client 20.215.248.112:20192] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/awh.php"] [unique_id "acWIfWHvvta9MPqU8PWEWgAAAQQ"]
[Fri Mar 27 03:26:54.845167 2026] [:error] [pid 62147:tid 62461] [client 20.215.248.112:4635] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/awh.php"] [unique_id "acWIfhPjxn06mcLazN6yxAAAAAE"]
[Fri Mar 27 03:26:55.592134 2026] [:error] [pid 62149:tid 62543] [client 20.215.248.112:4628] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/awh.php"] [unique_id "acWIf2Hvvta9MPqU8PWEXQAAARM"]
[Fri Mar 27 03:26:56.555750 2026] [:error] [pid 62147:tid 62479] [client 20.215.248.112:20652] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/awh.php"] [unique_id "acWIgBPjxn06mcLazN6yzAAAABM"]
[Fri Mar 27 03:26:57.308868 2026] [:error] [pid 62147:tid 62478] [client 20.215.248.112:20614] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/24.php"] [unique_id "acWIgRPjxn06mcLazN6y0AAAABI"]
[Fri Mar 27 03:26:58.031379 2026] [:error] [pid 62149:tid 62545] [client 20.215.248.112:29651] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/24.php"] [unique_id "acWIgmHvvta9MPqU8PWEXwAAARU"]
[Fri Mar 27 03:26:58.942623 2026] [:error] [pid 62551:tid 62562] [client 20.215.248.112:39710] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/24.php"] [unique_id "acWIgoQvFHgfE1g4p7C4KAAAAcg"]
[Fri Mar 27 03:27:00.414941 2026] [:error] [pid 62148:tid 62521] [client 20.215.248.112:47316] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/24.php"] [unique_id "acWIhIduik-mTruBKFWJVAAAAFg"]
[Fri Mar 27 03:27:01.234206 2026] [:error] [pid 44058:tid 44073] [client 20.215.248.112:20618] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zz8.php"] [unique_id "acWIheqp9u5CVRGdZPFMSAAAAI0"]
[Fri Mar 27 03:27:02.028702 2026] [:error] [pid 44058:tid 44081] [client 20.215.248.112:39769] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zz8.php"] [unique_id "acWIhuqp9u5CVRGdZPFMTwAAAJU"]
[Fri Mar 27 03:27:04.032830 2026] [:error] [pid 44058:tid 44075] [client 20.215.248.112:32739] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zz8.php"] [unique_id "acWIiOqp9u5CVRGdZPFMXwAAAI8"]
[Fri Mar 27 03:27:05.160952 2026] [:error] [pid 44058:tid 44082] [client 20.215.248.112:52839] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zz8.php"] [unique_id "acWIieqp9u5CVRGdZPFMaQAAAJY"]
[Fri Mar 27 03:27:05.973987 2026] [:error] [pid 62147:tid 62460] [client 20.215.248.112:35846] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/feokc.php"] [unique_id "acWIiRPjxn06mcLazN6y4gAAAAA"]
[Fri Mar 27 03:27:06.685207 2026] [:error] [pid 62551:tid 62559] [client 20.215.248.112:32724] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/feokc.php"] [unique_id "acWIioQvFHgfE1g4p7C4NwAAAcU"]
[Fri Mar 27 03:27:07.329699 2026] [:error] [pid 44058:tid 44060] [client 20.215.248.112:52807] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/feokc.php"] [unique_id "acWIi-qp9u5CVRGdZPFMcgAAAIA"]
[Fri Mar 27 03:27:07.896912 2026] [:error] [pid 44058:tid 44075] [client 20.215.248.112:42976] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/feokc.php"] [unique_id "acWIi-qp9u5CVRGdZPFMdgAAAI8"]
[Fri Mar 27 03:27:09.004402 2026] [:error] [pid 44058:tid 44066] [client 20.215.248.112:27678] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fetch.php"] [unique_id "acWIjeqp9u5CVRGdZPFMfQAAAIY"]
[Fri Mar 27 03:27:10.795735 2026] [:error] [pid 44058:tid 44063] [client 20.215.248.112:50184] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fetch.php"] [unique_id "acWIjuqp9u5CVRGdZPFMggAAAIM"]
[Fri Mar 27 03:27:11.630607 2026] [:error] [pid 44058:tid 44076] [client 20.215.248.112:4270] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fetch.php"] [unique_id "acWIj-qp9u5CVRGdZPFMiAAAAJA"]
[Fri Mar 27 03:27:12.365425 2026] [:error] [pid 62147:tid 62463] [client 20.215.248.112:4261] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fetch.php"] [unique_id "acWIkBPjxn06mcLazN6y6QAAAAM"]
[Fri Mar 27 03:27:13.004245 2026] [:error] [pid 44058:tid 44073] [client 20.215.248.112:4760] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phpmini.php"] [unique_id "acWIkeqp9u5CVRGdZPFMjgAAAI0"]
[Fri Mar 27 03:27:13.740012 2026] [:error] [pid 62147:tid 62461] [client 20.215.248.112:39782] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phpmini.php"] [unique_id "acWIkRPjxn06mcLazN6y8gAAAAE"]
[Fri Mar 27 03:27:14.664309 2026] [:error] [pid 62147:tid 62478] [client 20.215.248.112:29679] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phpmini.php"] [unique_id "acWIkhPjxn06mcLazN6y9wAAABI"]
[Fri Mar 27 03:27:15.469713 2026] [:error] [pid 62147:tid 62467] [client 20.215.248.112:42944] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phpmini.php"] [unique_id "acWIkxPjxn06mcLazN6y-QAAAAc"]
[Fri Mar 27 03:27:16.035353 2026] [:error] [pid 62147:tid 62468] [client 20.215.248.112:37854] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/an7.php"] [unique_id "acWIlBPjxn06mcLazN6y_gAAAAg"]
[Fri Mar 27 03:27:16.761494 2026] [:error] [pid 62147:tid 62482] [client 20.215.248.112:35854] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/an7.php"] [unique_id "acWIlBPjxn06mcLazN6zAQAAABY"]
[Fri Mar 27 03:27:17.634143 2026] [:error] [pid 44058:tid 44081] [client 20.215.248.112:39794] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/an7.php"] [unique_id "acWIleqp9u5CVRGdZPFMmAAAAJU"]
[Fri Mar 27 03:27:18.244368 2026] [:error] [pid 62149:tid 62541] [client 20.215.248.112:43001] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/an7.php"] [unique_id "acWIlmHvvta9MPqU8PWEbwAAARE"]
[Fri Mar 27 03:27:19.215518 2026] [:error] [pid 62147:tid 62470] [client 20.215.248.112:4258] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tbute.php"] [unique_id "acWIlxPjxn06mcLazN6zDQAAAAo"]
[Fri Mar 27 03:27:19.807077 2026] [:error] [pid 44058:tid 44064] [client 20.215.248.112:35871] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tbute.php"] [unique_id "acWIl-qp9u5CVRGdZPFMmwAAAIQ"]
[Fri Mar 27 03:27:20.561558 2026] [:error] [pid 44058:tid 44077] [client 20.215.248.112:39791] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tbute.php"] [unique_id "acWImOqp9u5CVRGdZPFMngAAAJE"]
[Fri Mar 27 03:27:21.217699 2026] [:error] [pid 44058:tid 44060] [client 20.215.248.112:59174] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tbute.php"] [unique_id "acWImeqp9u5CVRGdZPFMoAAAAIA"]
[Fri Mar 27 03:27:21.859382 2026] [:error] [pid 44058:tid 44061] [client 20.215.248.112:4873] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/r3grt7.php"] [unique_id "acWImeqp9u5CVRGdZPFMpQAAAIE"]
[Fri Mar 27 03:27:22.467115 2026] [:error] [pid 44058:tid 44082] [client 20.215.248.112:32748] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/r3grt7.php"] [unique_id "acWImuqp9u5CVRGdZPFMrgAAAJY"]
[Fri Mar 27 03:27:23.053887 2026] [:error] [pid 62147:tid 62478] [client 20.215.248.112:29665] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/r3grt7.php"] [unique_id "acWImxPjxn06mcLazN6zFwAAABI"]
[Fri Mar 27 03:27:23.679001 2026] [:error] [pid 62148:tid 62506] [client 20.215.248.112:32745] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/r3grt7.php"] [unique_id "acWIm4duik-mTruBKFWJYAAAAEk"]
[Fri Mar 27 03:27:24.240741 2026] [:error] [pid 44058:tid 44071] [client 20.215.248.112:47326] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phina.php"] [unique_id "acWInOqp9u5CVRGdZPFMswAAAIs"]
[Fri Mar 27 03:27:24.843105 2026] [:error] [pid 62148:tid 62511] [client 20.215.248.112:29664] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phina.php"] [unique_id "acWInIduik-mTruBKFWJYgAAAE4"]
[Fri Mar 27 03:27:25.520631 2026] [:error] [pid 62149:tid 62534] [client 20.215.248.112:35888] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phina.php"] [unique_id "acWInWHvvta9MPqU8PWEhgAAAQo"]
[Fri Mar 27 03:27:26.284372 2026] [:error] [pid 44058:tid 44067] [client 20.215.248.112:50188] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phina.php"] [unique_id "acWInuqp9u5CVRGdZPFMuAAAAIc"]
[Fri Mar 27 03:27:26.850400 2026] [:error] [pid 62149:tid 62528] [client 20.215.248.112:4775] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jga.php"] [unique_id "acWInmHvvta9MPqU8PWEiQAAAQQ"]
[Fri Mar 27 03:27:27.565639 2026] [:error] [pid 62551:tid 62561] [client 20.215.248.112:4646] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jga.php"] [unique_id "acWIn4QvFHgfE1g4p7C4UwAAAcc"]
[Fri Mar 27 03:27:28.341715 2026] [:error] [pid 44058:tid 44067] [client 20.215.248.112:42960] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jga.php"] [unique_id "acWIoOqp9u5CVRGdZPFMwAAAAIc"]
[Fri Mar 27 03:27:28.904014 2026] [:error] [pid 44058:tid 44071] [client 20.215.248.112:42976] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jga.php"] [unique_id "acWIoOqp9u5CVRGdZPFMxQAAAIs"]
[Fri Mar 27 03:27:29.603355 2026] [:error] [pid 62149:tid 62534] [client 20.215.248.112:20659] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs6.php"] [unique_id "acWIoWHvvta9MPqU8PWEkAAAAQo"]
[Fri Mar 27 03:27:30.174115 2026] [:error] [pid 44058:tid 44080] [client 20.215.248.112:52801] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs6.php"] [unique_id "acWIouqp9u5CVRGdZPFMzwAAAJQ"]
[Fri Mar 27 03:27:31.003621 2026] [:error] [pid 62147:tid 62480] [client 20.215.248.112:4273] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs6.php"] [unique_id "acWIoxPjxn06mcLazN6zKwAAABQ"]
[Fri Mar 27 03:27:31.665832 2026] [:error] [pid 62149:tid 62540] [client 20.215.248.112:37845] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs6.php"] [unique_id "acWIo2Hvvta9MPqU8PWEkQAAARA"]
[Fri Mar 27 03:27:32.621447 2026] [:error] [pid 62147:tid 62481] [client 20.215.248.112:62800] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs7.php"] [unique_id "acWIpBPjxn06mcLazN6zMAAAABU"]
[Fri Mar 27 03:27:33.195349 2026] [:error] [pid 62149:tid 62538] [client 20.215.248.112:4225] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs7.php"] [unique_id "acWIpWHvvta9MPqU8PWEkwAAAQ4"]
[Fri Mar 27 03:27:33.750984 2026] [:error] [pid 44058:tid 44075] [client 20.215.248.112:42951] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs7.php"] [unique_id "acWIpeqp9u5CVRGdZPFM2QAAAI8"]
[Fri Mar 27 03:27:34.546143 2026] [:error] [pid 62149:tid 62541] [client 20.215.248.112:54983] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fs7.php"] [unique_id "acWIpmHvvta9MPqU8PWElwAAARE"]
[Fri Mar 27 03:27:35.145965 2026] [:error] [pid 62147:tid 62476] [client 20.215.248.112:39772] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kbfr.php"] [unique_id "acWIpxPjxn06mcLazN6zNwAAABA"]
[Fri Mar 27 03:27:35.723124 2026] [:error] [pid 62148:tid 62521] [client 20.215.248.112:50204] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kbfr.php"] [unique_id "acWIp4duik-mTruBKFWJbAAAAFg"]
[Fri Mar 27 03:27:36.403511 2026] [:error] [pid 62147:tid 62481] [client 20.215.248.112:53715] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kbfr.php"] [unique_id "acWIqBPjxn06mcLazN6zQAAAABU"]
[Fri Mar 27 03:27:36.929127 2026] [:error] [pid 62551:tid 62564] [client 20.215.248.112:29632] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/kbfr.php"] [unique_id "acWIqIQvFHgfE1g4p7C4XwAAAco"]
[Fri Mar 27 03:27:37.547724 2026] [:error] [pid 62551:tid 62577] [client 20.215.248.112:54994] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/595.php"] [unique_id "acWIqYQvFHgfE1g4p7C4YgAAAdc"]
[Fri Mar 27 03:27:38.166375 2026] [:error] [pid 62147:tid 62480] [client 20.215.248.112:32737] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/595.php"] [unique_id "acWIqhPjxn06mcLazN6zRAAAABQ"]
[Fri Mar 27 03:27:39.246479 2026] [:error] [pid 44058:tid 44073] [client 20.215.248.112:20670] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/595.php"] [unique_id "acWIq-qp9u5CVRGdZPFM5AAAAI0"]
[Fri Mar 27 03:27:39.903287 2026] [:error] [pid 62551:tid 62574] [client 20.215.248.112:53735] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/595.php"] [unique_id "acWIq4QvFHgfE1g4p7C4ZgAAAdQ"]
[Fri Mar 27 03:27:40.471876 2026] [:error] [pid 62551:tid 62557] [client 20.215.248.112:34625] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/x1.php"] [unique_id "acWIrIQvFHgfE1g4p7C4aAAAAcM"]
[Fri Mar 27 03:27:41.243348 2026] [:error] [pid 62147:tid 62476] [client 20.215.248.112:34664] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/x1.php"] [unique_id "acWIrRPjxn06mcLazN6zSQAAABA"]
[Fri Mar 27 03:27:41.814097 2026] [:error] [pid 62148:tid 62501] [client 20.215.248.112:53700] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/x1.php"] [unique_id "acWIrYduik-mTruBKFWJcwAAAEQ"]
[Fri Mar 27 03:27:42.472925 2026] [:error] [pid 62148:tid 62502] [client 20.215.248.112:32045] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/x1.php"] [unique_id "acWIroduik-mTruBKFWJdAAAAEU"]
[Fri Mar 27 03:27:43.179666 2026] [:error] [pid 44058:tid 44077] [client 20.215.248.112:59186] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gk.php"] [unique_id "acWIr-qp9u5CVRGdZPFM7gAAAJE"]
[Fri Mar 27 03:27:43.751161 2026] [:error] [pid 44058:tid 44070] [client 20.215.248.112:4262] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gk.php"] [unique_id "acWIr-qp9u5CVRGdZPFM8QAAAIo"]
[Fri Mar 27 03:28:00.797997 2026] [:error] [pid 62551:tid 62571] [client 20.215.248.112:4245] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws36.php"] [unique_id "acWIwIQvFHgfE1g4p7C4lgAAAdE"]
[Fri Mar 27 03:28:01.449956 2026] [:error] [pid 44058:tid 44070] [client 20.215.248.112:32061] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws36.php"] [unique_id "acWIweqp9u5CVRGdZPFNJQAAAIo"]
[Fri Mar 27 03:28:02.022132 2026] [:error] [pid 44058:tid 44060] [client 20.215.248.112:37852] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws36.php"] [unique_id "acWIwuqp9u5CVRGdZPFNKAAAAIA"]
[Fri Mar 27 03:28:02.603328 2026] [:error] [pid 44058:tid 44078] [client 20.215.248.112:53723] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws36.php"] [unique_id "acWIwuqp9u5CVRGdZPFNQwAAAJI"]
[Fri Mar 27 03:28:03.295733 2026] [:error] [pid 62149:tid 62536] [client 20.215.248.112:37844] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vwxbi.php"] [unique_id "acWIw2Hvvta9MPqU8PWEwQAAAQw"]
[Fri Mar 27 03:28:04.102948 2026] [:error] [pid 62147:tid 62483] [client 20.215.248.112:4275] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vwxbi.php"] [unique_id "acWIxBPjxn06mcLazN6zcwAAABc"]
[Fri Mar 27 03:28:04.853320 2026] [:error] [pid 62147:tid 62469] [client 20.215.248.112:64582] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vwxbi.php"] [unique_id "acWIxBPjxn06mcLazN6zdgAAAAk"]
[Fri Mar 27 03:28:05.485507 2026] [:error] [pid 62147:tid 62475] [client 20.215.248.112:4264] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vwxbi.php"] [unique_id "acWIxRPjxn06mcLazN6zegAAAA8"]
[Fri Mar 27 03:28:06.030006 2026] [:error] [pid 62148:tid 62504] [client 20.215.248.112:54550] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shellerr.php"] [unique_id "acWIxoduik-mTruBKFWJigAAAEc"]
[Fri Mar 27 03:28:06.637943 2026] [:error] [pid 62551:tid 62572] [client 20.215.248.112:64546] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shellerr.php"] [unique_id "acWIxoQvFHgfE1g4p7C4wgAAAdI"]
[Fri Mar 27 03:28:07.336975 2026] [:error] [pid 44058:tid 44067] [client 20.215.248.112:50502] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shellerr.php"] [unique_id "acWIx-qp9u5CVRGdZPFNdQAAAIc"]
[Fri Mar 27 03:28:07.900658 2026] [:error] [pid 44058:tid 44074] [client 20.215.248.112:36495] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/shellerr.php"] [unique_id "acWIx-qp9u5CVRGdZPFNeAAAAI4"]
[Fri Mar 27 03:28:08.545422 2026] [:error] [pid 62147:tid 62478] [client 20.215.248.112:55685] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vaza.php"] [unique_id "acWIyBPjxn06mcLazN6zfQAAABI"]
[Fri Mar 27 03:28:09.867168 2026] [:error] [pid 44058:tid 44066] [client 20.215.248.112:25202] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vaza.php"] [unique_id "acWIyeqp9u5CVRGdZPFNgQAAAIY"]
[Fri Mar 27 03:28:10.503246 2026] [:error] [pid 44058:tid 44083] [client 20.215.248.112:55732] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vaza.php"] [unique_id "acWIyuqp9u5CVRGdZPFNhQAAAJc"]
[Fri Mar 27 03:28:11.588051 2026] [:error] [pid 62551:tid 62577] [client 20.215.248.112:54579] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vaza.php"] [unique_id "acWIy4QvFHgfE1g4p7C4xQAAAdc"]
[Fri Mar 27 03:28:13.358717 2026] [:error] [pid 62149:tid 62530] [client 20.215.248.112:33329] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cvz.php"] [unique_id "acWIzWHvvta9MPqU8PWEzQAAAQY"]
[Fri Mar 27 03:28:17.360092 2026] [:error] [pid 62149:tid 62526] [client 20.215.248.112:27771] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cvz.php"] [unique_id "acWI0WHvvta9MPqU8PWE1AAAAQI"]
[Fri Mar 27 03:28:18.268313 2026] [:error] [pid 62149:tid 62537] [client 20.215.248.112:63234] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cvz.php"] [unique_id "acWI0mHvvta9MPqU8PWE1gAAAQ0"]
[Fri Mar 27 03:28:19.201229 2026] [:error] [pid 62551:tid 62577] [client 20.215.248.112:25187] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cvz.php"] [unique_id "acWI04QvFHgfE1g4p7C40AAAAdc"]
[Fri Mar 27 03:28:19.941476 2026] [:error] [pid 62148:tid 62504] [client 20.215.248.112:38515] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "acWI04duik-mTruBKFWJlAAAAEc"]
[Fri Mar 27 03:28:20.921229 2026] [:error] [pid 62149:tid 62544] [client 20.215.248.112:38505] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "acWI1GHvvta9MPqU8PWE2wAAARQ"]
[Fri Mar 27 03:28:21.679467 2026] [:error] [pid 62147:tid 62462] [client 20.215.248.112:25199] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "acWI1RPjxn06mcLazN6zmwAAAAI"]
[Fri Mar 27 03:28:22.483614 2026] [:error] [pid 62149:tid 62546] [client 20.215.248.112:21954] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "acWI1mHvvta9MPqU8PWE3wAAARY"]
[Fri Mar 27 03:28:23.293264 2026] [:error] [pid 62147:tid 62479] [client 20.215.248.112:46145] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aee.php"] [unique_id "acWI1xPjxn06mcLazN6znwAAABM"]
[Fri Mar 27 03:28:46.526413 2026] [:error] [pid 62149:tid 62537] [client 20.215.248.112:35232] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sweg.php"] [unique_id "acWI7mHvvta9MPqU8PWFFwAAAQ0"]
[Fri Mar 27 03:28:47.307928 2026] [:error] [pid 62148:tid 62517] [client 20.215.248.112:53164] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sweg.php"] [unique_id "acWI74duik-mTruBKFWJvwAAAFQ"]
[Fri Mar 27 03:28:47.968838 2026] [:error] [pid 44058:tid 44066] [client 20.215.248.112:35264] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sweg.php"] [unique_id "acWI7-qp9u5CVRGdZPFN6AAAAIY"]
[Fri Mar 27 03:28:48.578652 2026] [:error] [pid 44058:tid 44076] [client 20.215.248.112:23189] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sweg.php"] [unique_id "acWI8Oqp9u5CVRGdZPFN7AAAAJA"]
[Fri Mar 27 03:28:49.351548 2026] [:error] [pid 62551:tid 62554] [client 20.215.248.112:4311] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sql.php"] [unique_id "acWI8YQvFHgfE1g4p7C5AwAAAcA"]
[Fri Mar 27 03:28:49.933471 2026] [:error] [pid 62551:tid 62574] [client 20.215.248.112:30240] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sql.php"] [unique_id "acWI8YQvFHgfE1g4p7C5BwAAAdQ"]
[Fri Mar 27 03:28:50.703733 2026] [:error] [pid 62147:tid 62460] [client 20.215.248.112:23188] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sql.php"] [unique_id "acWI8hPjxn06mcLazN6z3wAAAAA"]
[Fri Mar 27 03:28:51.360820 2026] [:error] [pid 62147:tid 62482] [client 20.215.248.112:20096] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sql.php"] [unique_id "acWI8xPjxn06mcLazN6z5gAAABY"]
[Fri Mar 27 03:28:52.203673 2026] [:error] [pid 44058:tid 44063] [client 20.215.248.112:34618] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sc.php"] [unique_id "acWI9Oqp9u5CVRGdZPFN9AAAAIM"]
[Fri Mar 27 03:28:52.823935 2026] [:error] [pid 44058:tid 44072] [client 20.215.248.112:4561] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sc.php"] [unique_id "acWI9Oqp9u5CVRGdZPFN9gAAAIw"]
[Fri Mar 27 03:28:53.350980 2026] [:error] [pid 44058:tid 44070] [client 20.215.248.112:48371] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sc.php"] [unique_id "acWI9eqp9u5CVRGdZPFN_AAAAIo"]
[Fri Mar 27 03:28:53.965428 2026] [:error] [pid 62147:tid 62481] [client 20.215.248.112:57127] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sc.php"] [unique_id "acWI9RPjxn06mcLazN6z7wAAABU"]
[Fri Mar 27 03:28:54.706931 2026] [:error] [pid 62551:tid 62571] [client 20.215.248.112:58458] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acWI9oQvFHgfE1g4p7C5FAAAAdE"]
[Fri Mar 27 03:28:55.868399 2026] [:error] [pid 44058:tid 44075] [client 20.215.248.112:4314] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acWI9-qp9u5CVRGdZPFOCgAAAI8"]
[Fri Mar 27 03:28:56.576056 2026] [:error] [pid 44058:tid 44071] [client 20.215.248.112:60716] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acWI-Oqp9u5CVRGdZPFOEAAAAIs"]
[Fri Mar 27 03:28:57.342413 2026] [:error] [pid 44058:tid 44073] [client 20.215.248.112:4544] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/eee.php"] [unique_id "acWI-eqp9u5CVRGdZPFOEwAAAI0"]
[Fri Mar 27 03:28:58.144834 2026] [:error] [pid 62147:tid 62474] [client 20.215.248.112:33975] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gptsh.php"] [unique_id "acWI-hPjxn06mcLazN6z9wAAAA4"]
[Fri Mar 27 03:28:58.840022 2026] [:error] [pid 62147:tid 62467] [client 20.215.248.112:20102] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gptsh.php"] [unique_id "acWI-hPjxn06mcLazN6z_QAAAAc"]
[Fri Mar 27 03:29:15.808945 2026] [:error] [pid 62147:tid 62464] [client 20.215.248.112:29025] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bfuKK.php"] [unique_id "acWJCxPjxn06mcLazN60HgAAAAQ"]
[Fri Mar 27 03:29:17.315860 2026] [:error] [pid 44058:tid 44078] [client 20.215.248.112:39167] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bfuKK.php"] [unique_id "acWJDeqp9u5CVRGdZPFOTQAAAJI"]
[Fri Mar 27 03:29:18.049868 2026] [:error] [pid 44058:tid 44077] [client 20.215.248.112:40390] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bfuKK.php"] [unique_id "acWJDuqp9u5CVRGdZPFOUQAAAJE"]
[Fri Mar 27 03:29:18.670294 2026] [:error] [pid 62147:tid 62474] [client 20.215.248.112:55336] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bfuKK.php"] [unique_id "acWJDhPjxn06mcLazN60IAAAAA4"]
[Fri Mar 27 03:29:19.285118 2026] [:error] [pid 44058:tid 44065] [client 20.215.248.112:60771] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/OpVq6.php"] [unique_id "acWJD-qp9u5CVRGdZPFOWQAAAIU"]
[Fri Mar 27 03:29:20.007345 2026] [:error] [pid 44058:tid 44069] [client 20.215.248.112:49153] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/OpVq6.php"] [unique_id "acWJEOqp9u5CVRGdZPFOXgAAAIk"]
[Fri Mar 27 03:29:20.653321 2026] [:error] [pid 62149:tid 62544] [client 20.215.248.112:35967] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/OpVq6.php"] [unique_id "acWJEGHvvta9MPqU8PWFPwAAARQ"]
[Fri Mar 27 03:29:21.213250 2026] [:error] [pid 62147:tid 62463] [client 20.215.248.112:59925] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/OpVq6.php"] [unique_id "acWJERPjxn06mcLazN60KAAAAAM"]
[Fri Mar 27 03:29:21.953457 2026] [:error] [pid 44058:tid 44084] [client 20.215.248.112:50854] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Q73BO.php"] [unique_id "acWJEeqp9u5CVRGdZPFOaAAAAJg"]
[Fri Mar 27 03:29:22.542187 2026] [:error] [pid 62149:tid 62527] [client 20.215.248.112:55996] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Q73BO.php"] [unique_id "acWJEmHvvta9MPqU8PWFQgAAAQM"]
[Fri Mar 27 03:29:23.153865 2026] [:error] [pid 44058:tid 44075] [client 20.215.248.112:49180] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Q73BO.php"] [unique_id "acWJE-qp9u5CVRGdZPFObAAAAI8"]
[Fri Mar 27 03:29:23.779378 2026] [:error] [pid 44058:tid 44078] [client 20.215.248.112:42910] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Q73BO.php"] [unique_id "acWJE-qp9u5CVRGdZPFObwAAAJI"]
[Fri Mar 27 03:29:24.348516 2026] [:error] [pid 62551:tid 62575] [client 20.215.248.112:55961] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rmpoa.php"] [unique_id "acWJFIQvFHgfE1g4p7C5SQAAAdU"]
[Fri Mar 27 03:29:25.187835 2026] [:error] [pid 44058:tid 44068] [client 20.215.248.112:26384] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rmpoa.php"] [unique_id "acWJFeqp9u5CVRGdZPFOdwAAAIg"]
[Fri Mar 27 03:29:25.756708 2026] [:error] [pid 44058:tid 44080] [client 20.215.248.112:51945] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rmpoa.php"] [unique_id "acWJFeqp9u5CVRGdZPFOewAAAJQ"]
[Fri Mar 27 03:29:26.312805 2026] [:error] [pid 44058:tid 44068] [client 20.215.248.112:39152] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rmpoa.php"] [unique_id "acWJFuqp9u5CVRGdZPFOfgAAAIg"]
[Fri Mar 27 03:29:27.007170 2026] [:error] [pid 62551:tid 62556] [client 20.215.248.112:40398] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wgift1.php"] [unique_id "acWJF4QvFHgfE1g4p7C5TAAAAcI"]
[Fri Mar 27 03:29:27.569708 2026] [:error] [pid 44058:tid 44074] [client 20.215.248.112:26396] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wgift1.php"] [unique_id "acWJF-qp9u5CVRGdZPFOgwAAAI4"]
[Fri Mar 27 03:29:28.173625 2026] [:error] [pid 62551:tid 62570] [client 20.215.248.112:59964] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wgift1.php"] [unique_id "acWJGIQvFHgfE1g4p7C5TwAAAdA"]
[Fri Mar 27 03:29:28.779170 2026] [:error] [pid 62551:tid 62571] [client 20.215.248.112:42927] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wgift1.php"] [unique_id "acWJGIQvFHgfE1g4p7C5UAAAAdE"]
[Fri Mar 27 03:29:29.384688 2026] [:error] [pid 44058:tid 44077] [client 20.215.248.112:64143] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acWJGeqp9u5CVRGdZPFOjwAAAJE"]
[Fri Mar 27 03:29:29.955874 2026] [:error] [pid 44058:tid 44063] [client 20.215.248.112:42923] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acWJGeqp9u5CVRGdZPFOlAAAAIM"]
[Fri Mar 27 03:29:30.636690 2026] [:error] [pid 44058:tid 44067] [client 20.215.248.112:64546] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acWJGuqp9u5CVRGdZPFOlwAAAIc"]
[Fri Mar 27 03:29:31.223663 2026] [:error] [pid 62147:tid 62478] [client 20.215.248.112:42937] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "acWJGxPjxn06mcLazN60OgAAABI"]
[Fri Mar 27 03:29:31.904066 2026] [:error] [pid 44058:tid 44079] [client 20.215.248.112:41702] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xper1.php"] [unique_id "acWJG-qp9u5CVRGdZPFOnQAAAJM"]
[Fri Mar 27 03:29:32.441110 2026] [:error] [pid 62147:tid 62462] [client 20.215.248.112:48949] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xper1.php"] [unique_id "acWJHBPjxn06mcLazN60PQAAAAI"]
[Fri Mar 27 03:29:33.036242 2026] [:error] [pid 62148:tid 62505] [client 20.215.248.112:64153] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xper1.php"] [unique_id "acWJHYduik-mTruBKFWJ1gAAAEg"]
[Fri Mar 27 03:29:33.629328 2026] [:error] [pid 44058:tid 44068] [client 20.215.248.112:55947] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xper1.php"] [unique_id "acWJHeqp9u5CVRGdZPFOqAAAAIg"]
[Fri Mar 27 03:29:34.353943 2026] [:error] [pid 62551:tid 62568] [client 20.215.248.112:51874] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gelio1.php"] [unique_id "acWJHoQvFHgfE1g4p7C5VQAAAc4"]
[Fri Mar 27 03:29:35.019498 2026] [:error] [pid 44058:tid 44074] [client 20.215.248.112:20659] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gelio1.php"] [unique_id "acWJH-qp9u5CVRGdZPFOtAAAAI4"]
[Fri Mar 27 03:29:35.905687 2026] [:error] [pid 44058:tid 44080] [client 20.215.248.112:58419] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gelio1.php"] [unique_id "acWJH-qp9u5CVRGdZPFOvAAAAJQ"]
[Fri Mar 27 03:29:36.535252 2026] [:error] [pid 62551:tid 62561] [client 20.215.248.112:41687] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gelio1.php"] [unique_id "acWJIIQvFHgfE1g4p7C5WAAAAcc"]
[Fri Mar 27 03:29:37.160564 2026] [:error] [pid 62551:tid 62570] [client 20.215.248.112:51892] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v2.php"] [unique_id "acWJIYQvFHgfE1g4p7C5WwAAAdA"]
[Fri Mar 27 03:29:37.842548 2026] [:error] [pid 44058:tid 44076] [client 20.215.248.112:54216] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v2.php"] [unique_id "acWJIeqp9u5CVRGdZPFOxAAAAJA"]
[Fri Mar 27 03:29:38.534990 2026] [:error] [pid 44058:tid 44062] [client 20.215.248.112:59612] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v2.php"] [unique_id "acWJIuqp9u5CVRGdZPFOywAAAII"]
[Fri Mar 27 03:29:39.385806 2026] [:error] [pid 44058:tid 44077] [client 20.215.248.112:33376] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v2.php"] [unique_id "acWJI-qp9u5CVRGdZPFOzAAAAJE"]
[Fri Mar 27 03:29:40.111444 2026] [:error] [pid 62147:tid 62477] [client 20.215.248.112:56341] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v3.php"] [unique_id "acWJJBPjxn06mcLazN60SQAAABE"]
[Fri Mar 27 03:29:40.725438 2026] [:error] [pid 62147:tid 62471] [client 20.215.248.112:60325] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v3.php"] [unique_id "acWJJBPjxn06mcLazN60SwAAAAs"]
[Fri Mar 27 03:29:41.516331 2026] [:error] [pid 62147:tid 62483] [client 20.215.248.112:49244] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v3.php"] [unique_id "acWJJRPjxn06mcLazN60TQAAABc"]
[Fri Mar 27 03:29:42.243838 2026] [:error] [pid 62147:tid 62464] [client 20.215.248.112:63345] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v3.php"] [unique_id "acWJJhPjxn06mcLazN60UwAAAAQ"]
[Fri Mar 27 03:29:42.815103 2026] [:error] [pid 44058:tid 44065] [client 20.215.248.112:34041] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v4.php"] [unique_id "acWJJuqp9u5CVRGdZPFO1wAAAIU"]
[Fri Mar 27 03:29:43.635783 2026] [:error] [pid 44058:tid 44074] [client 20.215.248.112:59620] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v4.php"] [unique_id "acWJJ-qp9u5CVRGdZPFO3QAAAI4"]
[Fri Mar 27 03:29:44.314882 2026] [:error] [pid 44058:tid 44071] [client 20.215.248.112:46081] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v4.php"] [unique_id "acWJKOqp9u5CVRGdZPFO4wAAAIs"]
[Fri Mar 27 03:29:45.092191 2026] [:error] [pid 62148:tid 62515] [client 20.215.248.112:51845] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/v4.php"] [unique_id "acWJKYduik-mTruBKFWJ5wAAAFI"]
[Fri Mar 27 03:29:45.713641 2026] [:error] [pid 62148:tid 62517] [client 20.215.248.112:34013] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ant.php"] [unique_id "acWJKYduik-mTruBKFWJ6gAAAFQ"]
[Fri Mar 27 03:29:46.309662 2026] [:error] [pid 62149:tid 62536] [client 20.215.248.112:34009] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ant.php"] [unique_id "acWJKmHvvta9MPqU8PWFTAAAAQw"]
[Fri Mar 27 03:29:47.179457 2026] [:error] [pid 62149:tid 62542] [client 20.215.248.112:43616] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ant.php"] [unique_id "acWJK2Hvvta9MPqU8PWFUgAAARI"]
[Fri Mar 27 03:29:47.948878 2026] [:error] [pid 62149:tid 62540] [client 20.215.248.112:60322] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ant.php"] [unique_id "acWJK2Hvvta9MPqU8PWFVgAAARA"]
[Fri Mar 27 03:29:48.640149 2026] [:error] [pid 62148:tid 62505] [client 20.215.248.112:46115] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acWJLIduik-mTruBKFWJ7QAAAEg"]
[Fri Mar 27 03:29:49.252635 2026] [:error] [pid 44058:tid 44077] [client 20.215.248.112:25768] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acWJLeqp9u5CVRGdZPFO7gAAAJE"]
[Fri Mar 27 03:29:49.864465 2026] [:error] [pid 44058:tid 44075] [client 20.215.248.112:56356] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acWJLeqp9u5CVRGdZPFO8AAAAI8"]
[Fri Mar 27 03:29:50.725697 2026] [:error] [pid 62148:tid 62508] [client 20.215.248.112:25738] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "acWJLoduik-mTruBKFWJ7wAAAEs"]
[Fri Mar 27 03:29:51.330924 2026] [:error] [pid 44058:tid 44063] [client 20.215.248.112:51854] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cc13.php"] [unique_id "acWJL-qp9u5CVRGdZPFO-gAAAIM"]
[Fri Mar 27 03:29:52.133527 2026] [:error] [pid 62149:tid 62545] [client 20.215.248.112:63351] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cc13.php"] [unique_id "acWJMGHvvta9MPqU8PWFWQAAARU"]
[Fri Mar 27 03:29:53.372144 2026] [:error] [pid 62551:tid 62578] [client 20.215.248.112:41664] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cc13.php"] [unique_id "acWJMYQvFHgfE1g4p7C5ZQAAAdg"]
[Fri Mar 27 03:29:53.949481 2026] [:error] [pid 62148:tid 62514] [client 20.215.248.112:56371] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cc13.php"] [unique_id "acWJMYduik-mTruBKFWJ-QAAAFE"]
[Fri Mar 27 03:29:54.530962 2026] [:error] [pid 62147:tid 62470] [client 20.215.248.112:4959] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bnm.php"] [unique_id "acWJMhPjxn06mcLazN60ZAAAAAo"]
[Fri Mar 27 03:29:55.263627 2026] [:error] [pid 62149:tid 62534] [client 20.215.248.112:46136] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bnm.php"] [unique_id "acWJM2Hvvta9MPqU8PWFXgAAAQo"]
[Fri Mar 27 03:29:55.913308 2026] [:error] [pid 62551:tid 62578] [client 20.215.248.112:25781] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bnm.php"] [unique_id "acWJM4QvFHgfE1g4p7C5bgAAAdg"]
[Fri Mar 27 03:29:56.752434 2026] [:error] [pid 62148:tid 62516] [client 20.215.248.112:50284] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bnm.php"] [unique_id "acWJNIduik-mTruBKFWJ-gAAAFM"]
[Fri Mar 27 03:29:57.740571 2026] [:error] [pid 62149:tid 62533] [client 20.215.248.112:56382] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccs.php"] [unique_id "acWJNWHvvta9MPqU8PWFYAAAAQk"]
[Fri Mar 27 03:29:58.394849 2026] [:error] [pid 62551:tid 62575] [client 20.215.248.112:34004] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccs.php"] [unique_id "acWJNoQvFHgfE1g4p7C5bwAAAdU"]
[Fri Mar 27 03:29:59.235382 2026] [:error] [pid 62149:tid 62528] [client 20.215.248.112:63314] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccs.php"] [unique_id "acWJN2Hvvta9MPqU8PWFYgAAAQQ"]
[Fri Mar 27 03:30:00.105686 2026] [:error] [pid 62147:tid 62483] [client 20.215.248.112:56334] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccs.php"] [unique_id "acWJOBPjxn06mcLazN60fAAAABc"]
[Fri Mar 27 03:30:00.654167 2026] [:error] [pid 62147:tid 62479] [client 20.215.248.112:56350] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccu.php"] [unique_id "acWJOBPjxn06mcLazN60fwAAABM"]
[Fri Mar 27 03:30:01.262864 2026] [:error] [pid 62147:tid 62484] [client 20.215.248.112:50482] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccu.php"] [unique_id "acWJORPjxn06mcLazN60hAAAABg"]
[Fri Mar 27 03:30:01.832851 2026] [:error] [pid 44058:tid 44078] [client 20.215.248.112:33398] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccu.php"] [unique_id "acWJOeqp9u5CVRGdZPFPEwAAAJI"]
[Fri Mar 27 03:30:03.066899 2026] [:error] [pid 62147:tid 62461] [client 20.215.248.112:28990] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccu.php"] [unique_id "acWJOxPjxn06mcLazN60igAAAAE"]
[Fri Mar 27 03:30:04.898724 2026] [:error] [pid 44058:tid 44084] [client 20.215.248.112:45490] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/albin.php"] [unique_id "acWJPOqp9u5CVRGdZPFPHQAAAJg"]
[Fri Mar 27 03:30:05.475699 2026] [:error] [pid 62147:tid 62466] [client 20.215.248.112:33373] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/albin.php"] [unique_id "acWJPRPjxn06mcLazN60kQAAAAY"]
[Fri Mar 27 03:30:06.122146 2026] [:error] [pid 62147:tid 62460] [client 20.215.248.112:51894] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/albin.php"] [unique_id "acWJPhPjxn06mcLazN60kwAAAAA"]
[Fri Mar 27 03:30:06.826808 2026] [:error] [pid 62551:tid 62573] [client 20.215.248.112:50288] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/albin.php"] [unique_id "acWJPoQvFHgfE1g4p7C5cQAAAdM"]
[Fri Mar 27 03:30:07.533331 2026] [:error] [pid 62147:tid 62465] [client 20.215.248.112:45503] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/north1.php"] [unique_id "acWJPxPjxn06mcLazN60lgAAAAU"]
[Fri Mar 27 03:30:08.475225 2026] [:error] [pid 44058:tid 44083] [client 20.215.248.112:4983] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/north1.php"] [unique_id "acWJQOqp9u5CVRGdZPFPKwAAAJc"]
[Fri Mar 27 03:30:09.110466 2026] [:error] [pid 44058:tid 44065] [client 20.215.248.112:50438] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/north1.php"] [unique_id "acWJQeqp9u5CVRGdZPFPMgAAAIU"]
[Fri Mar 27 03:30:09.731171 2026] [:error] [pid 44058:tid 44081] [client 20.215.248.112:49254] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/north1.php"] [unique_id "acWJQeqp9u5CVRGdZPFPOAAAAJU"]
[Fri Mar 27 03:30:10.455918 2026] [:error] [pid 62551:tid 62572] [client 20.215.248.112:28970] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dragonshell.php"] [unique_id "acWJQoQvFHgfE1g4p7C5dQAAAdI"]
[Fri Mar 27 03:30:10.993709 2026] [:error] [pid 62147:tid 62462] [client 20.215.248.112:60350] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dragonshell.php"] [unique_id "acWJQhPjxn06mcLazN60oAAAAAI"]
[Fri Mar 27 03:30:11.889618 2026] [:error] [pid 62149:tid 62530] [client 20.215.248.112:45501] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dragonshell.php"] [unique_id "acWJQ2Hvvta9MPqU8PWFcwAAAQY"]
[Fri Mar 27 03:30:12.536767 2026] [:error] [pid 62148:tid 62513] [client 20.215.248.112:65001] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dragonshell.php"] [unique_id "acWJRIduik-mTruBKFWKCAAAAFA"]
[Fri Mar 27 03:30:13.053036 2026] [:error] [pid 62147:tid 62471] [client 20.215.248.112:56780] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ggb.php"] [unique_id "acWJRRPjxn06mcLazN60qAAAAAs"]
[Fri Mar 27 03:30:13.605500 2026] [:error] [pid 44058:tid 44080] [client 20.215.248.112:33394] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ggb.php"] [unique_id "acWJReqp9u5CVRGdZPFPQwAAAJQ"]
[Fri Mar 27 03:30:30.341566 2026] [:error] [pid 44058:tid 44075] [client 20.215.248.112:50273] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acWJVuqp9u5CVRGdZPFP2wAAAI8"]
[Fri Mar 27 03:30:31.470373 2026] [:error] [pid 44058:tid 44072] [client 20.215.248.112:45484] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acWJV-qp9u5CVRGdZPFP4gAAAIw"]
[Fri Mar 27 03:30:32.265201 2026] [:error] [pid 44058:tid 44074] [client 20.215.248.112:50441] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acWJWOqp9u5CVRGdZPFP5QAAAI4"]
[Fri Mar 27 03:30:33.239303 2026] [:error] [pid 62147:tid 62478] [client 20.215.248.112:65021] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/wta.php"] [unique_id "acWJWRPjxn06mcLazN60xgAAABI"]
[Fri Mar 27 03:30:35.029454 2026] [:error] [pid 44058:tid 44082] [client 20.215.248.112:57610] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acWJW-qp9u5CVRGdZPFP8QAAAJY"]
[Fri Mar 27 03:30:35.798928 2026] [:error] [pid 62148:tid 62503] [client 20.215.248.112:31498] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acWJW4duik-mTruBKFWKKwAAAEY"]
[Fri Mar 27 03:30:36.711490 2026] [:error] [pid 62551:tid 62565] [client 20.215.248.112:49829] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acWJXIQvFHgfE1g4p7C5nAAAAcs"]
[Fri Mar 27 03:30:37.322577 2026] [:error] [pid 62148:tid 62520] [client 20.215.248.112:53576] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/dtyh.php"] [unique_id "acWJXYduik-mTruBKFWKLgAAAFc"]
[Fri Mar 27 03:30:38.307035 2026] [:error] [pid 62147:tid 62472] [client 20.215.248.112:50274] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dtyh.php"] [unique_id "acWJXhPjxn06mcLazN60zwAAAAw"]
[Fri Mar 27 03:30:39.250883 2026] [:error] [pid 62147:tid 62464] [client 20.215.248.112:62738] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dtyh.php"] [unique_id "acWJXxPjxn06mcLazN601QAAAAQ"]
[Fri Mar 27 03:30:40.749428 2026] [:error] [pid 62551:tid 62554] [client 20.215.248.112:31503] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dtyh.php"] [unique_id "acWJYIQvFHgfE1g4p7C5pgAAAcA"]
[Fri Mar 27 03:30:41.746513 2026] [:error] [pid 44058:tid 44061] [client 20.215.248.112:31512] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dtyh.php"] [unique_id "acWJYeqp9u5CVRGdZPFP-QAAAIE"]
[Fri Mar 27 03:30:46.780531 2026] [:error] [pid 62147:tid 62470] [client 20.215.248.112:50466] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wta.php"] [unique_id "acWJZhPjxn06mcLazN608gAAAAo"]
[Fri Mar 27 03:30:52.193923 2026] [:error] [pid 62147:tid 62472] [client 20.215.248.112:41008] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wta.php"] [unique_id "acWJbBPjxn06mcLazN60_gAAAAw"]
[Fri Mar 27 03:30:55.686913 2026] [:error] [pid 62551:tid 62554] [client 20.215.248.112:57640] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wta.php"] [unique_id "acWJb4QvFHgfE1g4p7C5tAAAAcA"]
[Fri Mar 27 03:30:58.558750 2026] [:error] [pid 62551:tid 62562] [client 20.215.248.112:57618] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acWJcoQvFHgfE1g4p7C5vAAAAcg"]
[Fri Mar 27 03:30:59.633342 2026] [:error] [pid 44058:tid 44077] [client 20.215.248.112:61506] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acWJc-qp9u5CVRGdZPFQJQAAAJE"]
[Fri Mar 27 03:31:00.409640 2026] [:error] [pid 62147:tid 62477] [client 20.215.248.112:57612] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acWJdBPjxn06mcLazN61DwAAABE"]
[Fri Mar 27 03:31:01.260866 2026] [:error] [pid 62147:tid 62483] [client 20.215.248.112:59541] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws77.php"] [unique_id "acWJdRPjxn06mcLazN61EgAAABc"]
[Fri Mar 27 03:31:01.853987 2026] [:error] [pid 62147:tid 62475] [client 20.215.248.112:59529] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acWJdRPjxn06mcLazN61FQAAAA8"]
[Fri Mar 27 03:31:02.766739 2026] [:error] [pid 62149:tid 62543] [client 20.215.248.112:53591] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acWJdmHvvta9MPqU8PWFmgAAARM"]
[Fri Mar 27 03:31:03.439382 2026] [:error] [pid 62147:tid 62472] [client 20.215.248.112:36586] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acWJdxPjxn06mcLazN61GQAAAAw"]
[Fri Mar 27 03:31:04.071995 2026] [:error] [pid 62147:tid 62476] [client 20.215.248.112:62763] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acWJeBPjxn06mcLazN61HwAAABA"]
[Fri Mar 27 03:31:04.846085 2026] [:error] [pid 62147:tid 62468] [client 20.215.248.112:62769] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/saorix1.php"] [unique_id "acWJeBPjxn06mcLazN61JQAAAAg"]
[Fri Mar 27 03:31:05.693206 2026] [:error] [pid 44058:tid 44063] [client 20.215.248.112:49811] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/saorix1.php"] [unique_id "acWJeeqp9u5CVRGdZPFQNwAAAIM"]
[Fri Mar 27 03:31:06.634890 2026] [:error] [pid 62148:tid 62504] [client 20.215.248.112:54932] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/saorix1.php"] [unique_id "acWJeoduik-mTruBKFWKQwAAAEc"]
[Fri Mar 27 03:31:08.629546 2026] [:error] [pid 62149:tid 62544] [client 20.215.248.112:53627] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/saorix1.php"] [unique_id "acWJfGHvvta9MPqU8PWFngAAARQ"]
[Fri Mar 27 03:31:10.585686 2026] [:error] [pid 44058:tid 44064] [client 20.215.248.112:61563] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-class.php"] [unique_id "acWJfuqp9u5CVRGdZPFQRwAAAIQ"]
[Fri Mar 27 03:31:11.700716 2026] [:error] [pid 62149:tid 62535] [client 20.215.248.112:30952] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-class.php"] [unique_id "acWJf2Hvvta9MPqU8PWFqQAAAQs"]
[Fri Mar 27 03:31:13.469739 2026] [:error] [pid 62147:tid 62468] [client 20.215.248.112:31494] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-class.php"] [unique_id "acWJgRPjxn06mcLazN61MgAAAAg"]
[Fri Mar 27 03:31:14.399611 2026] [:error] [pid 62551:tid 62578] [client 20.215.248.112:36603] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-class.php"] [unique_id "acWJgoQvFHgfE1g4p7C5xAAAAdg"]
[Fri Mar 27 03:31:15.159303 2026] [:error] [pid 62147:tid 62481] [client 20.215.248.112:36591] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acWJgxPjxn06mcLazN61OgAAABU"]
[Fri Mar 27 03:31:16.270881 2026] [:error] [pid 62147:tid 62460] [client 20.215.248.112:32667] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acWJhBPjxn06mcLazN61PgAAAAA"]
[Fri Mar 27 03:31:17.368445 2026] [:error] [pid 44058:tid 44084] [client 20.215.248.112:28343] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acWJheqp9u5CVRGdZPFQSwAAAJg"]
[Fri Mar 27 03:31:18.132685 2026] [:error] [pid 62148:tid 62509] [client 20.215.248.112:49832] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uuu.php"] [unique_id "acWJhoduik-mTruBKFWKTAAAAEw"]
[Fri Mar 27 03:31:18.762635 2026] [:error] [pid 44058:tid 44075] [client 20.215.248.112:61509] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-load.php"] [unique_id "acWJhuqp9u5CVRGdZPFQVAAAAI8"]
[Fri Mar 27 03:31:19.515862 2026] [:error] [pid 62149:tid 62538] [client 20.215.248.112:40960] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-load.php"] [unique_id "acWJh2Hvvta9MPqU8PWFugAAAQ4"]
[Fri Mar 27 03:31:20.695987 2026] [:error] [pid 62149:tid 62537] [client 20.215.248.112:46597] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-load.php"] [unique_id "acWJiGHvvta9MPqU8PWFvQAAAQ0"]
[Fri Mar 27 03:31:21.390062 2026] [:error] [pid 62148:tid 62501] [client 20.215.248.112:61553] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-load.php"] [unique_id "acWJiYduik-mTruBKFWKTgAAAEQ"]
[Fri Mar 27 03:31:22.236995 2026] [:error] [pid 62551:tid 62572] [client 20.215.248.112:61544] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gpt-sh.php"] [unique_id "acWJioQvFHgfE1g4p7C5zgAAAdI"]
[Fri Mar 27 03:31:22.908867 2026] [:error] [pid 62149:tid 62539] [client 20.215.248.112:59235] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gpt-sh.php"] [unique_id "acWJimHvvta9MPqU8PWFwAAAAQ8"]
[Fri Mar 27 03:31:23.611142 2026] [:error] [pid 62147:tid 62462] [client 20.215.248.112:65362] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gpt-sh.php"] [unique_id "acWJixPjxn06mcLazN61TgAAAAI"]
[Fri Mar 27 03:31:24.332723 2026] [:error] [pid 62148:tid 62517] [client 20.215.248.112:25824] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gpt-sh.php"] [unique_id "acWJjIduik-mTruBKFWKVgAAAFQ"]
[Fri Mar 27 03:31:25.124481 2026] [:error] [pid 62551:tid 62558] [client 20.215.248.112:46655] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bywaf.php"] [unique_id "acWJjYQvFHgfE1g4p7C50wAAAcQ"]
[Fri Mar 27 03:31:25.836823 2026] [:error] [pid 62147:tid 62471] [client 20.215.248.112:46653] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bywaf.php"] [unique_id "acWJjRPjxn06mcLazN61VgAAAAs"]
[Fri Mar 27 03:31:26.702189 2026] [:error] [pid 62551:tid 62562] [client 20.215.248.112:36594] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bywaf.php"] [unique_id "acWJjoQvFHgfE1g4p7C52QAAAcg"]
[Fri Mar 27 03:31:27.431986 2026] [:error] [pid 62551:tid 62570] [client 20.215.248.112:62746] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bywaf.php"] [unique_id "acWJj4QvFHgfE1g4p7C53AAAAdA"]
[Fri Mar 27 03:31:28.111530 2026] [:error] [pid 62551:tid 62554] [client 20.215.248.112:52791] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-true.php"] [unique_id "acWJkIQvFHgfE1g4p7C54gAAAcA"]
[Fri Mar 27 03:31:28.817516 2026] [:error] [pid 44058:tid 44074] [client 20.215.248.112:59211] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-true.php"] [unique_id "acWJkOqp9u5CVRGdZPFQZgAAAI4"]
[Fri Mar 27 03:31:46.476988 2026] [:error] [pid 44058:tid 44075] [client 20.215.248.112:52737] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ticket.php"] [unique_id "acWJouqp9u5CVRGdZPFQqAAAAI8"]
[Fri Mar 27 03:31:47.391767 2026] [:error] [pid 44058:tid 44077] [client 20.215.248.112:53220] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ticket.php"] [unique_id "acWJo-qp9u5CVRGdZPFQrAAAAJE"]
[Fri Mar 27 03:31:48.098473 2026] [:error] [pid 44058:tid 44066] [client 20.215.248.112:65289] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ticket.php"] [unique_id "acWJpOqp9u5CVRGdZPFQrgAAAIY"]
[Fri Mar 27 03:31:48.772567 2026] [:error] [pid 62149:tid 62546] [client 20.215.248.112:30939] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ticket.php"] [unique_id "acWJpGHvvta9MPqU8PWF1QAAARY"]
[Fri Mar 27 03:31:49.574410 2026] [:error] [pid 62149:tid 62527] [client 20.215.248.112:54951] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wglum1.php"] [unique_id "acWJpWHvvta9MPqU8PWF1gAAAQM"]
[Fri Mar 27 03:31:50.223445 2026] [:error] [pid 44058:tid 44081] [client 20.215.248.112:65317] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wglum1.php"] [unique_id "acWJpuqp9u5CVRGdZPFQwAAAAJU"]
[Fri Mar 27 03:31:50.914334 2026] [:error] [pid 62551:tid 62576] [client 20.215.248.112:59215] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wglum1.php"] [unique_id "acWJpoQvFHgfE1g4p7C6DwAAAdY"]
[Fri Mar 27 03:31:51.635717 2026] [:error] [pid 62551:tid 62563] [client 20.215.248.112:36601] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wglum1.php"] [unique_id "acWJp4QvFHgfE1g4p7C6EAAAAck"]
[Fri Mar 27 03:31:52.275651 2026] [:error] [pid 62551:tid 62562] [client 20.215.248.112:28347] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xpwer1.php"] [unique_id "acWJqIQvFHgfE1g4p7C6FwAAAcg"]
[Fri Mar 27 03:31:52.961601 2026] [:error] [pid 44058:tid 44081] [client 20.215.248.112:46714] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xpwer1.php"] [unique_id "acWJqOqp9u5CVRGdZPFQyAAAAJU"]
[Fri Mar 27 03:31:53.871472 2026] [:error] [pid 44058:tid 44063] [client 20.215.248.112:59260] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xpwer1.php"] [unique_id "acWJqeqp9u5CVRGdZPFQywAAAIM"]
[Fri Mar 27 03:31:54.605758 2026] [:error] [pid 62147:tid 62482] [client 20.215.248.112:4190] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xpwer1.php"] [unique_id "acWJqhPjxn06mcLazN61mAAAABY"]
[Fri Mar 27 03:31:55.273626 2026] [:error] [pid 44058:tid 44062] [client 20.215.248.112:46717] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/yuzuru1.php"] [unique_id "acWJq-qp9u5CVRGdZPFQzwAAAII"]
[Fri Mar 27 03:31:56.128118 2026] [:error] [pid 62147:tid 62462] [client 20.215.248.112:65285] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/yuzuru1.php"] [unique_id "acWJrBPjxn06mcLazN61oQAAAAI"]
[Fri Mar 27 03:31:56.828517 2026] [:error] [pid 62149:tid 62535] [client 20.215.248.112:30925] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/yuzuru1.php"] [unique_id "acWJrGHvvta9MPqU8PWF3AAAAQs"]
[Fri Mar 27 03:31:57.513290 2026] [:error] [pid 44058:tid 44081] [client 20.215.248.112:4177] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/yuzuru1.php"] [unique_id "acWJreqp9u5CVRGdZPFQ1QAAAJU"]
[Fri Mar 27 03:31:58.194025 2026] [:error] [pid 44058:tid 44084] [client 20.215.248.112:64919] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wdone1.php"] [unique_id "acWJruqp9u5CVRGdZPFQ2AAAAJg"]
[Fri Mar 27 03:31:59.022317 2026] [:error] [pid 62148:tid 62503] [client 20.215.248.112:44276] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wdone1.php"] [unique_id "acWJr4duik-mTruBKFWKdgAAAEY"]
[Fri Mar 27 03:31:59.776283 2026] [:error] [pid 44058:tid 44064] [client 20.215.248.112:52320] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wdone1.php"] [unique_id "acWJr-qp9u5CVRGdZPFQ3gAAAIQ"]
[Fri Mar 27 03:32:00.455970 2026] [:error] [pid 62551:tid 62566] [client 20.215.248.112:65375] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wdone1.php"] [unique_id "acWJsIQvFHgfE1g4p7C6JQAAAcw"]
[Fri Mar 27 03:32:01.113199 2026] [:error] [pid 62148:tid 62507] [client 20.215.248.112:65374] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xpass.php"] [unique_id "acWJsYduik-mTruBKFWKeQAAAEo"]
[Fri Mar 27 03:32:01.754296 2026] [:error] [pid 62551:tid 62562] [client 20.215.248.112:52326] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xpass.php"] [unique_id "acWJsYQvFHgfE1g4p7C6JwAAAcg"]
[Fri Mar 27 03:32:02.365873 2026] [:error] [pid 62148:tid 62506] [client 20.215.248.112:59228] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xpass.php"] [unique_id "acWJsoduik-mTruBKFWKfgAAAEk"]
[Fri Mar 27 03:32:03.051927 2026] [:error] [pid 62551:tid 62569] [client 20.215.248.112:46690] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xpass.php"] [unique_id "acWJs4QvFHgfE1g4p7C6LQAAAc8"]
[Fri Mar 27 03:32:03.686018 2026] [:error] [pid 62147:tid 62466] [client 20.215.248.112:52312] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ad.php"] [unique_id "acWJsxPjxn06mcLazN61pwAAAAY"]
[Fri Mar 27 03:32:04.343121 2026] [:error] [pid 62551:tid 62555] [client 20.215.248.112:65301] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ad.php"] [unique_id "acWJtIQvFHgfE1g4p7C6LwAAAcE"]
[Fri Mar 27 03:32:05.043849 2026] [:error] [pid 62551:tid 62577] [client 20.215.248.112:46666] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ad.php"] [unique_id "acWJtYQvFHgfE1g4p7C6MwAAAdc"]
[Fri Mar 27 03:32:05.692307 2026] [:error] [pid 62551:tid 62565] [client 20.215.248.112:44284] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ad.php"] [unique_id "acWJtYQvFHgfE1g4p7C6NQAAAcs"]
[Fri Mar 27 03:32:06.388698 2026] [:error] [pid 62147:tid 62482] [client 20.215.248.112:52290] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h02ugyh.php"] [unique_id "acWJthPjxn06mcLazN61qgAAABY"]
[Fri Mar 27 03:32:06.929587 2026] [:error] [pid 62551:tid 62569] [client 20.215.248.112:56056] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h02ugyh.php"] [unique_id "acWJtoQvFHgfE1g4p7C6PAAAAc8"]
[Fri Mar 27 03:32:07.527577 2026] [:error] [pid 62149:tid 62538] [client 20.215.248.112:52758] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h02ugyh.php"] [unique_id "acWJt2Hvvta9MPqU8PWF6wAAAQ4"]
[Fri Mar 27 03:32:08.198327 2026] [:error] [pid 44058:tid 44073] [client 20.215.248.112:52743] [client 20.215.248.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h02ugyh.php"] [unique_id "acWJuOqp9u5CVRGdZPFQ9gAAAI0"]
[Fri Mar 27 07:46:27.920647 2026] [:error] [pid 27851:tid 27862] [client 20.19.177.219:53439] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bootstrap.php"] [unique_id "acXFU3R2ccxe3RMCLbourwAAAMQ"]
[Fri Mar 27 07:46:28.920936 2026] [:error] [pid 27851:tid 27874] [client 20.19.177.219:6522] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bootstrap.php"] [unique_id "acXFVHR2ccxe3RMCLbousAAAANA"]
[Fri Mar 27 07:46:30.233679 2026] [:error] [pid 4293:tid 4300] [client 20.19.177.219:53427] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bootstrap.php"] [unique_id "acXFVpLjeJUC3OKtEx-cKwAAAUU"]
[Fri Mar 27 07:46:31.930136 2026] [:error] [pid 4293:tid 4298] [client 20.19.177.219:51796] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bootstrap.php"] [unique_id "acXFV5LjeJUC3OKtEx-cMQAAAUM"]
[Fri Mar 27 07:46:32.678880 2026] [:error] [pid 4293:tid 4304] [client 20.19.177.219:6959] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asasx.php"] [unique_id "acXFWJLjeJUC3OKtEx-cNQAAAUk"]
[Fri Mar 27 07:46:33.584867 2026] [:error] [pid 27750:tid 27826] [client 20.19.177.219:6373] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asasx.php"] [unique_id "acXFWYaSil5rd17ieLxOYgAAAIg"]
[Fri Mar 27 07:46:34.113400 2026] [:error] [pid 63897:tid 63912] [client 20.19.177.219:6377] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asasx.php"] [unique_id "acXFWmVSkmYmLu7ycYgnBgAAAQ0"]
[Fri Mar 27 07:46:34.621014 2026] [:error] [pid 63897:tid 63901] [client 20.19.177.219:53415] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/asasx.php"] [unique_id "acXFWmVSkmYmLu7ycYgnCAAAAQI"]
[Fri Mar 27 07:46:35.262540 2026] [:error] [pid 4341:tid 4354] [client 20.19.177.219:6467] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Sanskrit.php"] [unique_id "acXFW-KJWrNB5dMlERE1UAAAAYs"]
[Fri Mar 27 07:46:35.859690 2026] [:error] [pid 4341:tid 4365] [client 20.19.177.219:6932] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Sanskrit.php"] [unique_id "acXFW-KJWrNB5dMlERE1VAAAAZY"]
[Fri Mar 27 07:46:37.932406 2026] [:error] [pid 63897:tid 63905] [client 20.19.177.219:54348] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Sanskrit.php"] [unique_id "acXFXWVSkmYmLu7ycYgnEgAAAQY"]
[Fri Mar 27 07:46:39.229481 2026] [:error] [pid 63897:tid 63919] [client 20.19.177.219:51825] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Sanskrit.php"] [unique_id "acXFX2VSkmYmLu7ycYgnFgAAARQ"]
[Fri Mar 27 07:46:40.051817 2026] [:error] [pid 27743:tid 27783] [client 20.19.177.219:51804] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/green.php"] [unique_id "acXFYCA46UYYLqzw99AOYwAAABM"]
[Fri Mar 27 07:46:41.623539 2026] [:error] [pid 27750:tid 27842] [client 20.19.177.219:6939] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/green.php"] [unique_id "acXFYYaSil5rd17ieLxOaQAAAJg"]
[Fri Mar 27 07:46:43.381791 2026] [:error] [pid 27750:tid 27836] [client 20.19.177.219:6923] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/green.php"] [unique_id "acXFY4aSil5rd17ieLxObQAAAJI"]
[Fri Mar 27 07:46:44.700904 2026] [:error] [pid 27851:tid 27868] [client 20.19.177.219:6366] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/green.php"] [unique_id "acXFZHR2ccxe3RMCLbouwAAAAMo"]
[Fri Mar 27 07:46:46.376374 2026] [:error] [pid 63897:tid 63910] [client 20.19.177.219:6481] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws87.php"] [unique_id "acXFZmVSkmYmLu7ycYgnJAAAAQs"]
[Fri Mar 27 07:46:49.943277 2026] [:error] [pid 27749:tid 27810] [client 20.19.177.219:51835] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws87.php"] [unique_id "acXFacEqyoMni2Q6_X5x1gAAAFM"]
[Fri Mar 27 07:46:50.711984 2026] [:error] [pid 27750:tid 27830] [client 20.19.177.219:6623] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws87.php"] [unique_id "acXFaoaSil5rd17ieLxOfwAAAIw"]
[Fri Mar 27 07:46:51.668915 2026] [:error] [pid 27750:tid 27839] [client 20.19.177.219:51792] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws87.php"] [unique_id "acXFa4aSil5rd17ieLxOggAAAJU"]
[Fri Mar 27 07:46:52.711554 2026] [:error] [pid 27851:tid 27866] [client 20.19.177.219:53392] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wxfyf.php"] [unique_id "acXFbHR2ccxe3RMCLbouzgAAAMg"]
[Fri Mar 27 07:46:53.621987 2026] [:error] [pid 27851:tid 27868] [client 20.19.177.219:6394] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wxfyf.php"] [unique_id "acXFbXR2ccxe3RMCLbou0gAAAMo"]
[Fri Mar 27 07:46:54.430964 2026] [:error] [pid 27851:tid 27871] [client 20.19.177.219:53390] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wxfyf.php"] [unique_id "acXFbnR2ccxe3RMCLbou1gAAAM0"]
[Fri Mar 27 07:46:55.222903 2026] [:error] [pid 27750:tid 27842] [client 20.19.177.219:53414] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wxfyf.php"] [unique_id "acXFb4aSil5rd17ieLxOhQAAAJg"]
[Fri Mar 27 07:46:56.079452 2026] [:error] [pid 4293:tid 4305] [client 20.19.177.219:54382] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "acXFcJLjeJUC3OKtEx-cawAAAUo"]
[Fri Mar 27 07:46:56.715973 2026] [:error] [pid 4293:tid 4295] [client 20.19.177.219:6611] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "acXFcJLjeJUC3OKtEx-ccAAAAUA"]
[Fri Mar 27 07:46:57.436467 2026] [:error] [pid 4293:tid 4318] [client 20.19.177.219:6507] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "acXFcZLjeJUC3OKtEx-ccwAAAVc"]
[Fri Mar 27 07:46:58.131068 2026] [:error] [pid 27851:tid 27878] [client 20.19.177.219:6360] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "acXFcnR2ccxe3RMCLbou3gAAANQ"]
[Fri Mar 27 07:46:58.877518 2026] [:error] [pid 4341:tid 4365] [client 20.19.177.219:6599] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gpt-sh.php"] [unique_id "acXFcuKJWrNB5dMlERE1YgAAAZY"]
[Fri Mar 27 07:47:00.178942 2026] [:error] [pid 4293:tid 4311] [client 20.19.177.219:51787] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gpt-sh.php"] [unique_id "acXFdJLjeJUC3OKtEx-cfgAAAVA"]
[Fri Mar 27 07:47:00.871638 2026] [:error] [pid 4293:tid 4302] [client 20.19.177.219:53380] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gpt-sh.php"] [unique_id "acXFdJLjeJUC3OKtEx-cgAAAAUc"]
[Fri Mar 27 07:47:01.606816 2026] [:error] [pid 4293:tid 4295] [client 20.19.177.219:54337] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gpt-sh.php"] [unique_id "acXFdZLjeJUC3OKtEx-ciQAAAUA"]
[Fri Mar 27 07:47:02.371298 2026] [:error] [pid 4293:tid 4302] [client 20.19.177.219:51788] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ne2026.php"] [unique_id "acXFdpLjeJUC3OKtEx-cjgAAAUc"]
[Fri Mar 27 07:47:03.477049 2026] [:error] [pid 4293:tid 4314] [client 20.19.177.219:6395] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ne2026.php"] [unique_id "acXFd5LjeJUC3OKtEx-ckwAAAVM"]
[Fri Mar 27 07:47:04.366777 2026] [:error] [pid 27749:tid 27794] [client 20.19.177.219:53387] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ne2026.php"] [unique_id "acXFeMEqyoMni2Q6_X5x4gAAAEM"]
[Fri Mar 27 07:47:05.778344 2026] [:error] [pid 27749:tid 27812] [client 20.19.177.219:6378] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ne2026.php"] [unique_id "acXFecEqyoMni2Q6_X5x5wAAAFU"]
[Fri Mar 27 07:47:07.914211 2026] [:error] [pid 27851:tid 27865] [client 20.19.177.219:6509] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/2ksm17n.php"] [unique_id "acXFe3R2ccxe3RMCLbou6gAAAMc"]
[Fri Mar 27 07:47:10.208518 2026] [:error] [pid 4293:tid 4300] [client 20.19.177.219:7103] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/2ksm17n.php"] [unique_id "acXFfpLjeJUC3OKtEx-cogAAAUU"]
[Fri Mar 27 07:47:11.666415 2026] [:error] [pid 27750:tid 27836] [client 20.19.177.219:6973] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/2ksm17n.php"] [unique_id "acXFf4aSil5rd17ieLxOlwAAAJI"]
[Fri Mar 27 07:47:13.434275 2026] [:error] [pid 27749:tid 27812] [client 20.19.177.219:54345] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/2ksm17n.php"] [unique_id "acXFgcEqyoMni2Q6_X5x7gAAAFU"]
[Fri Mar 27 07:47:14.135920 2026] [:error] [pid 4293:tid 4317] [client 20.19.177.219:54394] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccs.php"] [unique_id "acXFgpLjeJUC3OKtEx-cuQAAAVY"]
[Fri Mar 27 07:47:14.807620 2026] [:error] [pid 4293:tid 4315] [client 20.19.177.219:6485] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccs.php"] [unique_id "acXFgpLjeJUC3OKtEx-cwQAAAVQ"]
[Fri Mar 27 07:47:15.803171 2026] [:error] [pid 63897:tid 63919] [client 20.19.177.219:53408] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccs.php"] [unique_id "acXFg2VSkmYmLu7ycYgnMwAAARQ"]
[Fri Mar 27 07:47:16.481959 2026] [:error] [pid 63897:tid 63903] [client 20.19.177.219:51823] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccs.php"] [unique_id "acXFhGVSkmYmLu7ycYgnNQAAAQQ"]
[Fri Mar 27 07:47:17.301160 2026] [:error] [pid 4341:tid 4360] [client 20.19.177.219:53424] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws81.php"] [unique_id "acXFheKJWrNB5dMlERE1hgAAAZE"]
[Fri Mar 27 07:47:18.002636 2026] [:error] [pid 63897:tid 63923] [client 20.19.177.219:54359] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws81.php"] [unique_id "acXFhmVSkmYmLu7ycYgnOQAAARg"]
[Fri Mar 27 07:47:18.622739 2026] [:error] [pid 63897:tid 63922] [client 20.19.177.219:6471] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws81.php"] [unique_id "acXFhmVSkmYmLu7ycYgnPAAAARc"]
[Fri Mar 27 07:47:19.159668 2026] [:error] [pid 63897:tid 63905] [client 20.19.177.219:6926] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws81.php"] [unique_id "acXFh2VSkmYmLu7ycYgnPgAAAQY"]
[Fri Mar 27 07:47:20.061903 2026] [:error] [pid 63897:tid 63900] [client 20.19.177.219:6992] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mh.php"] [unique_id "acXFiGVSkmYmLu7ycYgnRgAAAQE"]
[Fri Mar 27 07:47:21.292299 2026] [:error] [pid 63897:tid 63909] [client 20.19.177.219:6966] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mh.php"] [unique_id "acXFiWVSkmYmLu7ycYgnTQAAAQo"]
[Fri Mar 27 07:47:22.453444 2026] [:error] [pid 27750:tid 27836] [client 20.19.177.219:6386] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mh.php"] [unique_id "acXFioaSil5rd17ieLxOqAAAAJI"]
[Fri Mar 27 07:47:23.416119 2026] [:error] [pid 27750:tid 27823] [client 20.19.177.219:53378] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mh.php"] [unique_id "acXFi4aSil5rd17ieLxOrAAAAIU"]
[Fri Mar 27 07:47:24.251051 2026] [:error] [pid 63897:tid 63906] [client 20.19.177.219:6491] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vx.php"] [unique_id "acXFjGVSkmYmLu7ycYgnVAAAAQc"]
[Fri Mar 27 07:47:25.144920 2026] [:error] [pid 4341:tid 4354] [client 20.19.177.219:6343] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vx.php"] [unique_id "acXFjeKJWrNB5dMlERE1kgAAAYs"]
[Fri Mar 27 07:47:25.895794 2026] [:error] [pid 4293:tid 4318] [client 20.19.177.219:6951] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vx.php"] [unique_id "acXFjZLjeJUC3OKtEx-c4QAAAVc"]
[Fri Mar 27 07:47:51.185465 2026] [:error] [pid 4293:tid 4315] [client 20.19.177.219:6500] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acXFp5LjeJUC3OKtEx-dRwAAAVQ"]
[Fri Mar 27 07:47:51.778902 2026] [:error] [pid 4293:tid 4308] [client 20.19.177.219:51815] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acXFp5LjeJUC3OKtEx-dWQAAAU0"]
[Fri Mar 27 07:47:53.268931 2026] [:error] [pid 27851:tid 27870] [client 20.19.177.219:53407] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acXFqXR2ccxe3RMCLbovGAAAAMw"]
[Fri Mar 27 07:47:54.938430 2026] [:error] [pid 27749:tid 27809] [client 20.19.177.219:6928] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xfun.php"] [unique_id "acXFqsEqyoMni2Q6_X5yBwAAAFI"]
[Fri Mar 27 07:48:00.290228 2026] [:error] [pid 27750:tid 27838] [client 20.19.177.219:51827] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acXFsIaSil5rd17ieLxOwwAAAJQ"]
[Fri Mar 27 07:48:09.598786 2026] [:error] [pid 63897:tid 63914] [client 20.19.177.219:54387] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "acXFuWVSkmYmLu7ycYgnnwAAAQ8"]
[Fri Mar 27 07:48:12.295271 2026] [:error] [pid 4293:tid 4310] [client 20.19.177.219:6521] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acXFvJLjeJUC3OKtEx-eLQAAAU8"]
[Fri Mar 27 07:48:13.461356 2026] [:error] [pid 4293:tid 4301] [client 20.19.177.219:6967] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acXFvZLjeJUC3OKtEx-eNgAAAUY"]
[Fri Mar 27 07:48:16.582440 2026] [:error] [pid 63897:tid 63921] [client 20.19.177.219:6601] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acXFwGVSkmYmLu7ycYgnswAAARY"]
[Fri Mar 27 07:48:17.588917 2026] [:error] [pid 4293:tid 4310] [client 20.19.177.219:6376] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws86.php"] [unique_id "acXFwZLjeJUC3OKtEx-eVQAAAU8"]
[Fri Mar 27 07:48:18.785816 2026] [:error] [pid 4293:tid 4304] [client 20.19.177.219:6503] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acXFwpLjeJUC3OKtEx-eWgAAAUk"]
[Fri Mar 27 07:48:20.236988 2026] [:error] [pid 4293:tid 4312] [client 20.19.177.219:53420] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acXFxJLjeJUC3OKtEx-eYAAAAVE"]
[Fri Mar 27 07:48:22.669134 2026] [:error] [pid 63897:tid 63901] [client 20.19.177.219:6517] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acXFxmVSkmYmLu7ycYgnwwAAAQI"]
[Fri Mar 27 07:48:32.716449 2026] [:error] [pid 63897:tid 63909] [client 20.19.177.219:6476] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws85.php"] [unique_id "acXF0GVSkmYmLu7ycYgn0QAAAQo"]
[Fri Mar 27 07:48:34.743967 2026] [:error] [pid 4293:tid 4299] [client 20.19.177.219:54342] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acXF0pLjeJUC3OKtEx-ehAAAAUQ"]
[Fri Mar 27 07:48:36.350773 2026] [:error] [pid 27750:tid 27828] [client 20.19.177.219:6962] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acXF1IaSil5rd17ieLxO2QAAAIo"]
[Fri Mar 27 07:48:37.172734 2026] [:error] [pid 27750:tid 27839] [client 20.19.177.219:6930] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acXF1YaSil5rd17ieLxO2gAAAJU"]
[Fri Mar 27 07:48:38.504447 2026] [:error] [pid 4293:tid 4302] [client 20.19.177.219:6342] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/Cap.php"] [unique_id "acXF1pLjeJUC3OKtEx-eigAAAUc"]
[Fri Mar 27 07:48:40.938584 2026] [:error] [pid 4293:tid 4298] [client 20.19.177.219:6963] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h2.php"] [unique_id "acXF2JLjeJUC3OKtEx-ekQAAAUM"]
[Fri Mar 27 07:48:45.267577 2026] [:error] [pid 27749:tid 27800] [client 20.19.177.219:51812] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h2.php"] [unique_id "acXF3cEqyoMni2Q6_X5yGQAAAEk"]
[Fri Mar 27 07:48:46.332330 2026] [:error] [pid 4293:tid 4300] [client 20.19.177.219:6511] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h2.php"] [unique_id "acXF3pLjeJUC3OKtEx-eoQAAAUU"]
[Fri Mar 27 07:48:47.227565 2026] [:error] [pid 4293:tid 4301] [client 20.19.177.219:53381] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/h2.php"] [unique_id "acXF35LjeJUC3OKtEx-epAAAAUY"]
[Fri Mar 27 07:48:48.599874 2026] [:error] [pid 4293:tid 4302] [client 20.19.177.219:6361] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dass.php"] [unique_id "acXF4JLjeJUC3OKtEx-eqwAAAUc"]
[Fri Mar 27 07:49:09.783431 2026] [:error] [pid 4293:tid 4318] [client 20.19.177.219:6946] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acXF9ZLjeJUC3OKtEx-fZQAAAVc"]
[Fri Mar 27 07:49:11.184488 2026] [:error] [pid 27743:tid 27787] [client 20.19.177.219:6389] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acXF9yA46UYYLqzw99AO4AAAABc"]
[Fri Mar 27 07:49:13.576682 2026] [:error] [pid 4341:tid 4356] [client 20.19.177.219:6622] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acXF-eKJWrNB5dMlERE1_QAAAY0"]
[Fri Mar 27 07:49:15.686526 2026] [:error] [pid 27749:tid 27791] [client 20.19.177.219:54374] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inege.php"] [unique_id "acXF-8EqyoMni2Q6_X5yJgAAAEA"]
[Fri Mar 27 07:49:17.792837 2026] [:error] [pid 27749:tid 27803] [client 20.19.177.219:6359] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acXF_cEqyoMni2Q6_X5yKQAAAEw"]
[Fri Mar 27 07:49:19.128138 2026] [:error] [pid 27749:tid 27812] [client 20.19.177.219:51809] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acXF_8EqyoMni2Q6_X5yLgAAAFU"]
[Fri Mar 27 07:49:20.072938 2026] [:error] [pid 27749:tid 27804] [client 20.19.177.219:53416] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acXGAMEqyoMni2Q6_X5yMwAAAE0"]
[Fri Mar 27 07:49:21.862494 2026] [:error] [pid 4293:tid 4307] [client 20.19.177.219:6943] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acXGAZLjeJUC3OKtEx-fbAAAAUw"]
[Fri Mar 27 07:49:23.865152 2026] [:error] [pid 27851:tid 27879] [client 20.19.177.219:6514] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "acXGA3R2ccxe3RMCLbovXQAAANU"]
[Fri Mar 27 07:49:25.372126 2026] [:error] [pid 27750:tid 27833] [client 20.19.177.219:7130] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "acXGBYaSil5rd17ieLxO8wAAAI8"]
[Fri Mar 27 07:49:27.046480 2026] [:error] [pid 4341:tid 4346] [client 20.19.177.219:53401] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "acXGB-KJWrNB5dMlERE2AgAAAYM"]
[Fri Mar 27 07:49:29.100711 2026] [:error] [pid 4293:tid 4316] [client 20.19.177.219:51828] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/t.php"] [unique_id "acXGCZLjeJUC3OKtEx-ffwAAAVU"]
[Fri Mar 27 07:49:33.169143 2026] [:error] [pid 4293:tid 4297] [client 20.19.177.219:54367] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acXGDZLjeJUC3OKtEx-fjgAAAUI"]
[Fri Mar 27 07:49:34.121372 2026] [:error] [pid 27851:tid 27862] [client 20.19.177.219:53409] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acXGDnR2ccxe3RMCLbovcQAAAMQ"]
[Fri Mar 27 07:49:36.187851 2026] [:error] [pid 63897:tid 63917] [client 20.19.177.219:6392] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acXGEGVSkmYmLu7ycYgowAAAARI"]
[Fri Mar 27 07:49:39.780776 2026] [:error] [pid 4293:tid 4311] [client 20.19.177.219:7040] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-p2r3q9c8k4.php"] [unique_id "acXGE5LjeJUC3OKtEx-f0QAAAVA"]
[Fri Mar 27 07:49:52.811795 2026] [:error] [pid 63897:tid 63916] [client 20.19.177.219:6944] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/ws49.php"] [unique_id "acXGIGVSkmYmLu7ycYgo4QAAARE"]
[Fri Mar 27 07:49:53.590527 2026] [:error] [pid 4293:tid 4315] [client 20.19.177.219:54397] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/ws49.php"] [unique_id "acXGIZLjeJUC3OKtEx-f7wAAAVQ"]
[Fri Mar 27 07:49:54.161723 2026] [:error] [pid 4293:tid 4297] [client 20.19.177.219:6375] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/ws49.php"] [unique_id "acXGIpLjeJUC3OKtEx-f8gAAAUI"]
[Fri Mar 27 07:49:56.264566 2026] [:error] [pid 63897:tid 63914] [client 20.19.177.219:6344] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acXGJGVSkmYmLu7ycYgo5gAAAQ8"]
[Fri Mar 27 07:49:56.913360 2026] [:error] [pid 63897:tid 63899] [client 20.19.177.219:54354] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acXGJGVSkmYmLu7ycYgo6AAAAQA"]
[Fri Mar 27 07:49:57.951886 2026] [:error] [pid 4293:tid 4314] [client 20.19.177.219:6955] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acXGJZLjeJUC3OKtEx-f_gAAAVM"]
[Fri Mar 27 07:49:59.032610 2026] [:error] [pid 4341:tid 4351] [client 20.19.177.219:53389] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "acXGJ-KJWrNB5dMlERE2eQAAAYg"]
[Fri Mar 27 07:50:01.036002 2026] [:error] [pid 27750:tid 27826] [client 20.19.177.219:51786] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sa.php7"] [unique_id "acXGKYaSil5rd17ieLxPFgAAAIg"]
[Fri Mar 27 07:50:02.155019 2026] [:error] [pid 63897:tid 63901] [client 20.19.177.219:6593] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sa.php7"] [unique_id "acXGKmVSkmYmLu7ycYgpBAAAAQI"]
[Fri Mar 27 07:50:02.731569 2026] [:error] [pid 63897:tid 63909] [client 20.19.177.219:54391] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sa.php7"] [unique_id "acXGKmVSkmYmLu7ycYgpCQAAAQo"]
[Fri Mar 27 07:50:03.615202 2026] [:error] [pid 4293:tid 4315] [client 20.19.177.219:51802] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sa.php7"] [unique_id "acXGK5LjeJUC3OKtEx-gCwAAAVQ"]
[Fri Mar 27 07:50:05.153081 2026] [:error] [pid 4293:tid 4310] [client 20.19.177.219:7071] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jp.php"] [unique_id "acXGLZLjeJUC3OKtEx-gGAAAAU8"]
[Fri Mar 27 07:50:07.445545 2026] [:error] [pid 63897:tid 63914] [client 20.19.177.219:52911] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jp.php"] [unique_id "acXGL2VSkmYmLu7ycYgpEgAAAQ8"]
[Fri Mar 27 07:50:31.060108 2026] [:error] [pid 4293:tid 4298] [client 20.19.177.219:6341] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acXGR5LjeJUC3OKtEx-ghAAAAUM"]
[Fri Mar 27 07:50:31.787908 2026] [:error] [pid 27851:tid 27863] [client 20.19.177.219:6480] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acXGR3R2ccxe3RMCLbovwQAAAMU"]
[Fri Mar 27 07:50:32.498698 2026] [:error] [pid 4293:tid 4295] [client 20.19.177.219:6494] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acXGSJLjeJUC3OKtEx-ghQAAAUA"]
[Fri Mar 27 07:50:33.228617 2026] [:error] [pid 63897:tid 63918] [client 20.19.177.219:6921] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "acXGSWVSkmYmLu7ycYgpRwAAARM"]
[Fri Mar 27 07:50:34.460294 2026] [:error] [pid 4293:tid 4303] [client 20.19.177.219:6621] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acXGSpLjeJUC3OKtEx-glAAAAUg"]
[Fri Mar 27 07:50:35.150430 2026] [:error] [pid 63897:tid 63907] [client 20.19.177.219:7024] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acXGS2VSkmYmLu7ycYgpXwAAAQg"]
[Fri Mar 27 07:50:36.117252 2026] [:error] [pid 4341:tid 4347] [client 20.19.177.219:6964] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acXGTOKJWrNB5dMlERE3MQAAAYQ"]
[Fri Mar 27 07:50:36.901111 2026] [:error] [pid 4293:tid 4306] [client 20.19.177.219:51836] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog.php"] [unique_id "acXGTJLjeJUC3OKtEx-gnQAAAUs"]
[Fri Mar 27 07:50:38.512286 2026] [:error] [pid 27743:tid 27788] [client 20.19.177.219:6983] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acXGTiA46UYYLqzw99AO_gAAABg"]
[Fri Mar 27 07:50:39.893154 2026] [:error] [pid 4293:tid 4318] [client 20.19.177.219:53406] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acXGT5LjeJUC3OKtEx-gqwAAAVc"]
[Fri Mar 27 07:50:42.942250 2026] [:error] [pid 27743:tid 27774] [client 20.19.177.219:51785] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acXGUiA46UYYLqzw99APAQAAAAo"]
[Fri Mar 27 07:50:44.785670 2026] [:error] [pid 27750:tid 27824] [client 20.19.177.219:6465] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "acXGVIaSil5rd17ieLxPMAAAAIY"]
[Fri Mar 27 07:50:45.864318 2026] [:error] [pid 4293:tid 4304] [client 20.19.177.219:6934] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acXGVZLjeJUC3OKtEx-gvgAAAUk"]
[Fri Mar 27 07:50:48.363348 2026] [:error] [pid 4293:tid 4316] [client 20.19.177.219:6486] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acXGWJLjeJUC3OKtEx-g0gAAAVU"]
[Fri Mar 27 07:50:49.279452 2026] [:error] [pid 4341:tid 4365] [client 20.19.177.219:6519] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acXGWeKJWrNB5dMlERE3RAAAAZY"]
[Fri Mar 27 07:50:50.273698 2026] [:error] [pid 4293:tid 4306] [client 20.19.177.219:52155] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lib.php"] [unique_id "acXGWpLjeJUC3OKtEx-g5AAAAUs"]
[Fri Mar 27 07:50:51.264588 2026] [:error] [pid 4341:tid 4361] [client 20.19.177.219:7066] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acXGW-KJWrNB5dMlERE3RwAAAZI"]
[Fri Mar 27 07:50:52.110502 2026] [:error] [pid 4293:tid 4309] [client 20.19.177.219:53437] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acXGXJLjeJUC3OKtEx-g8wAAAU4"]
[Fri Mar 27 07:50:52.679402 2026] [:error] [pid 63897:tid 63899] [client 20.19.177.219:6612] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acXGXGVSkmYmLu7ycYgpigAAAQA"]
[Fri Mar 27 07:50:53.659227 2026] [:error] [pid 27851:tid 27878] [client 20.19.177.219:6919] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "acXGXXR2ccxe3RMCLbov1QAAANQ"]
[Fri Mar 27 07:50:55.748765 2026] [:error] [pid 4293:tid 4315] [client 20.19.177.219:53418] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acXGX5LjeJUC3OKtEx-hCwAAAVQ"]
[Fri Mar 27 07:50:57.033837 2026] [:error] [pid 63897:tid 63921] [client 20.19.177.219:54375] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acXGYWVSkmYmLu7ycYgptgAAARY"]
[Fri Mar 27 07:50:58.190134 2026] [:error] [pid 4293:tid 4317] [client 20.19.177.219:54386] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acXGYpLjeJUC3OKtEx-hJgAAAVY"]
[Fri Mar 27 07:50:59.552230 2026] [:error] [pid 4293:tid 4297] [client 20.19.177.219:54375] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "acXGY5LjeJUC3OKtEx-hMgAAAUI"]
[Fri Mar 27 07:51:01.162570 2026] [:error] [pid 63897:tid 63914] [client 20.19.177.219:6609] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ajax.php"] [unique_id "acXGZWVSkmYmLu7ycYgpywAAAQ8"]
[Fri Mar 27 07:51:01.864290 2026] [:error] [pid 4293:tid 4295] [client 20.19.177.219:51837] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ajax.php"] [unique_id "acXGZZLjeJUC3OKtEx-hRQAAAUA"]
[Fri Mar 27 07:51:02.678821 2026] [:error] [pid 4341:tid 4363] [client 20.19.177.219:51826] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ajax.php"] [unique_id "acXGZuKJWrNB5dMlERE3TAAAAZQ"]
[Fri Mar 27 07:51:04.138733 2026] [:error] [pid 4293:tid 4315] [client 20.19.177.219:7141] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ajax.php"] [unique_id "acXGaJLjeJUC3OKtEx-hUQAAAVQ"]
[Fri Mar 27 07:51:05.259450 2026] [:error] [pid 27743:tid 27787] [client 20.19.177.219:53428] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "acXGaSA46UYYLqzw99APDAAAABc"]
[Fri Mar 27 07:51:06.299889 2026] [:error] [pid 63897:tid 63923] [client 20.19.177.219:53417] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "acXGamVSkmYmLu7ycYgp2AAAARg"]
[Fri Mar 27 07:51:07.907838 2026] [:error] [pid 4293:tid 4305] [client 20.19.177.219:53393] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "acXGa5LjeJUC3OKtEx-haAAAAUo"]
[Fri Mar 27 07:51:09.623496 2026] [:error] [pid 4341:tid 4354] [client 20.19.177.219:6912] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "acXGbeKJWrNB5dMlERE3WAAAAYs"]
[Fri Mar 27 07:51:11.482027 2026] [:error] [pid 4293:tid 4302] [client 20.19.177.219:6358] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acXGb5LjeJUC3OKtEx-hgAAAAUc"]
[Fri Mar 27 07:51:12.336645 2026] [:error] [pid 4293:tid 4300] [client 20.19.177.219:51818] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acXGcJLjeJUC3OKtEx-hhwAAAUU"]
[Fri Mar 27 07:51:14.498456 2026] [:error] [pid 4293:tid 4295] [client 20.19.177.219:6391] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acXGcpLjeJUC3OKtEx-hmAAAAUA"]
[Fri Mar 27 07:51:15.265417 2026] [:error] [pid 27749:tid 27813] [client 20.19.177.219:53421] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/wp-blog.php"] [unique_id "acXGc8EqyoMni2Q6_X5yhgAAAFY"]
[Fri Mar 27 07:51:16.060740 2026] [:error] [pid 4293:tid 4300] [client 20.19.177.219:6383] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acXGdJLjeJUC3OKtEx-hpAAAAUU"]
[Fri Mar 27 07:51:16.829001 2026] [:error] [pid 27750:tid 27826] [client 20.19.177.219:6339] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acXGdIaSil5rd17ieLxPZQAAAIg"]
[Fri Mar 27 07:51:17.943376 2026] [:error] [pid 4293:tid 4317] [client 20.19.177.219:6595] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acXGdZLjeJUC3OKtEx-hrgAAAVY"]
[Fri Mar 27 07:51:18.556071 2026] [:error] [pid 4293:tid 4302] [client 20.19.177.219:6527] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/nw.php"] [unique_id "acXGdpLjeJUC3OKtEx-hsAAAAUc"]
[Fri Mar 27 07:51:19.342864 2026] [:error] [pid 4293:tid 4304] [client 20.19.177.219:6627] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acXGd5LjeJUC3OKtEx-htgAAAUk"]
[Fri Mar 27 07:51:20.451470 2026] [:error] [pid 63897:tid 63909] [client 20.19.177.219:6372] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acXGeGVSkmYmLu7ycYgqBgAAAQo"]
[Fri Mar 27 07:51:22.236566 2026] [:error] [pid 4293:tid 4314] [client 20.19.177.219:52880] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acXGepLjeJUC3OKtEx-hvgAAAVM"]
[Fri Mar 27 07:51:23.914136 2026] [:error] [pid 63897:tid 63907] [client 20.19.177.219:51835] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tool.php"] [unique_id "acXGe2VSkmYmLu7ycYgqGAAAAQg"]
[Fri Mar 27 07:51:26.172129 2026] [:error] [pid 27851:tid 27877] [client 20.19.177.219:6526] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/drhunthq.php"] [unique_id "acXGfnR2ccxe3RMCLbowDQAAANM"]
[Fri Mar 27 07:51:27.774745 2026] [:error] [pid 4293:tid 4309] [client 20.19.177.219:53431] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/drhunthq.php"] [unique_id "acXGf5LjeJUC3OKtEx-h3wAAAU4"]
[Fri Mar 27 07:51:49.571367 2026] [:error] [pid 4341:tid 4345] [client 20.19.177.219:6972] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-the.php"] [unique_id "acXGleKJWrNB5dMlERE3sgAAAYI"]
[Fri Mar 27 07:51:50.348997 2026] [:error] [pid 4341:tid 4352] [client 20.19.177.219:53413] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-the.php"] [unique_id "acXGluKJWrNB5dMlERE3tAAAAYk"]
[Fri Mar 27 07:51:51.903007 2026] [:error] [pid 4293:tid 4310] [client 20.19.177.219:54381] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-the.php"] [unique_id "acXGl5LjeJUC3OKtEx-iFgAAAU8"]
[Fri Mar 27 07:52:22.735341 2026] [:error] [pid 4293:tid 4312] [client 20.19.177.219:6399] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp5.php"] [unique_id "acXGtpLjeJUC3OKtEx-ijQAAAVE"]
[Fri Mar 27 07:52:23.735251 2026] [:error] [pid 27750:tid 27835] [client 20.19.177.219:54357] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp5.php"] [unique_id "acXGt4aSil5rd17ieLxPlwAAAJE"]
[Fri Mar 27 07:52:24.403147 2026] [:error] [pid 27750:tid 27831] [client 20.19.177.219:53411] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp5.php"] [unique_id "acXGuIaSil5rd17ieLxPmAAAAI0"]
[Fri Mar 27 07:52:25.272714 2026] [:error] [pid 4293:tid 4301] [client 20.19.177.219:6616] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp5.php"] [unique_id "acXGuZLjeJUC3OKtEx-ijwAAAUY"]
[Fri Mar 27 07:52:26.105109 2026] [:error] [pid 27851:tid 27875] [client 20.19.177.219:6611] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-access.php"] [unique_id "acXGunR2ccxe3RMCLbowTgAAANE"]
[Fri Mar 27 07:52:26.657417 2026] [:error] [pid 4293:tid 4311] [client 20.19.177.219:51777] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-access.php"] [unique_id "acXGupLjeJUC3OKtEx-ilQAAAVA"]
[Fri Mar 27 07:52:27.484461 2026] [:error] [pid 27851:tid 27861] [client 20.19.177.219:6925] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-access.php"] [unique_id "acXGu3R2ccxe3RMCLbowTwAAAMM"]
[Fri Mar 27 07:52:28.049746 2026] [:error] [pid 4293:tid 4298] [client 20.19.177.219:6917] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-access.php"] [unique_id "acXGvJLjeJUC3OKtEx-ingAAAUM"]
[Fri Mar 27 07:52:28.737353 2026] [:error] [pid 4293:tid 4311] [client 20.19.177.219:51781] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hots.php"] [unique_id "acXGvJLjeJUC3OKtEx-ioAAAAVA"]
[Fri Mar 27 07:52:29.270558 2026] [:error] [pid 27749:tid 27807] [client 20.19.177.219:53427] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hots.php"] [unique_id "acXGvcEqyoMni2Q6_X5ytgAAAFA"]
[Fri Mar 27 07:52:29.999471 2026] [:error] [pid 27851:tid 27860] [client 20.19.177.219:6958] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hots.php"] [unique_id "acXGvXR2ccxe3RMCLbowUQAAAMI"]
[Fri Mar 27 07:52:30.660162 2026] [:error] [pid 4341:tid 4349] [client 20.19.177.219:6596] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hots.php"] [unique_id "acXGvuKJWrNB5dMlERE39QAAAYY"]
[Fri Mar 27 07:52:31.607165 2026] [:error] [pid 27749:tid 27800] [client 20.19.177.219:51783] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin-footer.php"] [unique_id "acXGv8EqyoMni2Q6_X5yugAAAEk"]
[Fri Mar 27 07:52:32.259032 2026] [:error] [pid 63897:tid 63917] [client 20.19.177.219:6346] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin-footer.php"] [unique_id "acXGwGVSkmYmLu7ycYgqpgAAARI"]
[Fri Mar 27 07:52:32.946519 2026] [:error] [pid 63897:tid 63911] [client 20.19.177.219:7042] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin-footer.php"] [unique_id "acXGwGVSkmYmLu7ycYgqqgAAAQw"]
[Fri Mar 27 07:52:33.858692 2026] [:error] [pid 27749:tid 27815] [client 20.19.177.219:54336] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin-footer.php"] [unique_id "acXGwcEqyoMni2Q6_X5yvAAAAFg"]
[Fri Mar 27 07:52:34.716279 2026] [:error] [pid 63897:tid 63902] [client 20.19.177.219:6967] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws84.php"] [unique_id "acXGwmVSkmYmLu7ycYgqswAAAQM"]
[Fri Mar 27 07:52:35.417010 2026] [:error] [pid 63897:tid 63905] [client 20.19.177.219:51778] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws84.php"] [unique_id "acXGw2VSkmYmLu7ycYgquAAAAQY"]
[Fri Mar 27 07:52:36.142574 2026] [:error] [pid 27749:tid 27807] [client 20.19.177.219:54369] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws84.php"] [unique_id "acXGxMEqyoMni2Q6_X5ywwAAAFA"]
[Fri Mar 27 07:52:36.747438 2026] [:error] [pid 63897:tid 63912] [client 20.19.177.219:6635] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws84.php"] [unique_id "acXGxGVSkmYmLu7ycYgqvgAAAQ0"]
[Fri Mar 27 07:52:37.322739 2026] [:error] [pid 4341:tid 4351] [client 20.19.177.219:6365] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bnm.php"] [unique_id "acXGxeKJWrNB5dMlERE3-gAAAYg"]
[Fri Mar 27 07:52:37.925046 2026] [:error] [pid 27743:tid 27781] [client 20.19.177.219:6650] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bnm.php"] [unique_id "acXGxSA46UYYLqzw99APOAAAABE"]
[Fri Mar 27 07:52:38.635186 2026] [:error] [pid 63897:tid 63911] [client 20.19.177.219:54376] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bnm.php"] [unique_id "acXGxmVSkmYmLu7ycYgqxAAAAQw"]
[Fri Mar 27 07:52:39.290195 2026] [:error] [pid 63897:tid 63923] [client 20.19.177.219:6384] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bnm.php"] [unique_id "acXGx2VSkmYmLu7ycYgqyAAAARg"]
[Fri Mar 27 07:52:39.970006 2026] [:error] [pid 27743:tid 27787] [client 20.19.177.219:6918] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/amax.php"] [unique_id "acXGxyA46UYYLqzw99APPAAAABc"]
[Fri Mar 27 07:52:40.852474 2026] [:error] [pid 4293:tid 4299] [client 20.19.177.219:51794] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/amax.php"] [unique_id "acXGyJLjeJUC3OKtEx-iqQAAAUQ"]
[Fri Mar 27 07:52:41.437152 2026] [:error] [pid 63897:tid 63906] [client 20.19.177.219:52137] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/amax.php"] [unique_id "acXGyWVSkmYmLu7ycYgqywAAAQc"]
[Fri Mar 27 07:52:42.116471 2026] [:error] [pid 63897:tid 63904] [client 20.19.177.219:54351] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/amax.php"] [unique_id "acXGymVSkmYmLu7ycYgqzQAAAQU"]
[Fri Mar 27 07:52:42.731296 2026] [:error] [pid 27750:tid 27830] [client 20.19.177.219:6956] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/66.php"] [unique_id "acXGyoaSil5rd17ieLxPpQAAAIw"]
[Fri Mar 27 07:52:43.383911 2026] [:error] [pid 27851:tid 27866] [client 20.19.177.219:6376] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/66.php"] [unique_id "acXGy3R2ccxe3RMCLbowZgAAAMg"]
[Fri Mar 27 07:52:44.004501 2026] [:error] [pid 27743:tid 27785] [client 20.19.177.219:6937] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/66.php"] [unique_id "acXGzCA46UYYLqzw99APRAAAABU"]
[Fri Mar 27 07:52:44.619446 2026] [:error] [pid 27749:tid 27811] [client 20.19.177.219:6338] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/66.php"] [unique_id "acXGzMEqyoMni2Q6_X5yywAAAFQ"]
[Fri Mar 27 07:52:45.244278 2026] [:error] [pid 63897:tid 63903] [client 20.19.177.219:7045] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/file.php"] [unique_id "acXGzWVSkmYmLu7ycYgq1QAAAQQ"]
[Fri Mar 27 07:52:45.846076 2026] [:error] [pid 63897:tid 63919] [client 20.19.177.219:6931] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/file.php"] [unique_id "acXGzWVSkmYmLu7ycYgq4AAAARQ"]
[Fri Mar 27 07:52:46.386491 2026] [:error] [pid 63897:tid 63921] [client 20.19.177.219:6499] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/file.php"] [unique_id "acXGzmVSkmYmLu7ycYgq_QAAARY"]
[Fri Mar 27 07:52:47.191868 2026] [:error] [pid 27851:tid 27882] [client 20.19.177.219:51803] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/public/file.php"] [unique_id "acXGz3R2ccxe3RMCLbowagAAANg"]
[Fri Mar 27 07:52:47.944903 2026] [:error] [pid 27749:tid 27808] [client 20.19.177.219:6473] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/166.php"] [unique_id "acXGz8EqyoMni2Q6_X5yzAAAAFE"]
[Fri Mar 27 07:53:05.246612 2026] [:error] [pid 4341:tid 4365] [client 20.19.177.219:6504] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zc-104.php"] [unique_id "acXG4eKJWrNB5dMlERE4IAAAAZY"]
[Fri Mar 27 07:53:05.779448 2026] [:error] [pid 4293:tid 4316] [client 20.19.177.219:6336] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zc-104.php"] [unique_id "acXG4ZLjeJUC3OKtEx-i1gAAAVU"]
[Fri Mar 27 07:53:06.458410 2026] [:error] [pid 4293:tid 4304] [client 20.19.177.219:51796] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zc-104.php"] [unique_id "acXG4pLjeJUC3OKtEx-i1wAAAUk"]
[Fri Mar 27 07:53:07.262548 2026] [:error] [pid 63897:tid 63905] [client 20.19.177.219:6395] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/zc-104.php"] [unique_id "acXG42VSkmYmLu7ycYgrNAAAAQY"]
[Fri Mar 27 07:53:07.880521 2026] [:error] [pid 63897:tid 63911] [client 20.19.177.219:51807] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rzki.php"] [unique_id "acXG42VSkmYmLu7ycYgrNwAAAQw"]
[Fri Mar 27 07:53:08.634961 2026] [:error] [pid 4341:tid 4352] [client 20.19.177.219:52869] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rzki.php"] [unique_id "acXG5OKJWrNB5dMlERE4IgAAAYk"]
[Fri Mar 27 07:53:09.295681 2026] [:error] [pid 4293:tid 4311] [client 20.19.177.219:6924] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rzki.php"] [unique_id "acXG5ZLjeJUC3OKtEx-i2wAAAVA"]
[Fri Mar 27 07:53:09.931415 2026] [:error] [pid 4293:tid 4300] [client 20.19.177.219:6606] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rzki.php"] [unique_id "acXG5ZLjeJUC3OKtEx-i3gAAAUU"]
[Fri Mar 27 07:53:10.664280 2026] [:error] [pid 63897:tid 63900] [client 20.19.177.219:6381] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "acXG5mVSkmYmLu7ycYgrQAAAAQE"]
[Fri Mar 27 07:53:11.539504 2026] [:error] [pid 4341:tid 4351] [client 20.19.177.219:6626] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "acXG5-KJWrNB5dMlERE4JwAAAYg"]
[Fri Mar 27 07:53:12.993636 2026] [:error] [pid 4293:tid 4296] [client 20.19.177.219:51787] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "acXG6JLjeJUC3OKtEx-i5QAAAUE"]
[Fri Mar 27 07:53:14.153922 2026] [:error] [pid 63897:tid 63914] [client 20.19.177.219:51823] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "acXG6mVSkmYmLu7ycYgrRAAAAQ8"]
[Fri Mar 27 07:53:14.832402 2026] [:error] [pid 4341:tid 4344] [client 20.19.177.219:6597] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/d12.php"] [unique_id "acXG6uKJWrNB5dMlERE4KwAAAYE"]
[Fri Mar 27 07:53:15.495900 2026] [:error] [pid 4341:tid 4353] [client 20.19.177.219:6952] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/d12.php"] [unique_id "acXG6-KJWrNB5dMlERE4LgAAAYo"]
[Fri Mar 27 07:53:17.014499 2026] [:error] [pid 63897:tid 63916] [client 20.19.177.219:6502] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/d12.php"] [unique_id "acXG7WVSkmYmLu7ycYgrSAAAARE"]
[Fri Mar 27 07:53:17.702272 2026] [:error] [pid 27851:tid 27879] [client 20.19.177.219:6948] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/d12.php"] [unique_id "acXG7XR2ccxe3RMCLbowgQAAANU"]
[Fri Mar 27 07:53:18.499860 2026] [:error] [pid 27750:tid 27823] [client 20.19.177.219:54358] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/okxh.php"] [unique_id "acXG7oaSil5rd17ieLxPwgAAAIU"]
[Fri Mar 27 07:53:19.402417 2026] [:error] [pid 27851:tid 27869] [client 20.19.177.219:53394] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/okxh.php"] [unique_id "acXG73R2ccxe3RMCLbowhAAAAMs"]
[Fri Mar 27 07:53:20.257005 2026] [:error] [pid 27851:tid 27876] [client 20.19.177.219:6628] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/okxh.php"] [unique_id "acXG8HR2ccxe3RMCLbowhQAAANI"]
[Fri Mar 27 07:53:21.349928 2026] [:error] [pid 4293:tid 4298] [client 20.19.177.219:51815] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/okxh.php"] [unique_id "acXG8ZLjeJUC3OKtEx-jDgAAAUM"]
[Fri Mar 27 07:53:23.483991 2026] [:error] [pid 4293:tid 4311] [client 20.19.177.219:6361] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/55b76.php"] [unique_id "acXG85LjeJUC3OKtEx-jFQAAAVA"]
[Fri Mar 27 07:53:24.979523 2026] [:error] [pid 27743:tid 27770] [client 20.19.177.219:6599] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/55b76.php"] [unique_id "acXG9CA46UYYLqzw99APTwAAAAY"]
[Fri Mar 27 07:53:26.489438 2026] [:error] [pid 27750:tid 27827] [client 20.19.177.219:53402] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/55b76.php"] [unique_id "acXG9oaSil5rd17ieLxPzgAAAIk"]
[Fri Mar 27 07:53:31.814472 2026] [:error] [pid 63897:tid 63905] [client 20.19.177.219:6368] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/55b76.php"] [unique_id "acXG-2VSkmYmLu7ycYgrbgAAAQY"]
[Fri Mar 27 07:53:32.776121 2026] [:error] [pid 27749:tid 27805] [client 20.19.177.219:54373] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tt.php"] [unique_id "acXG_MEqyoMni2Q6_X5zAAAAAE4"]
[Fri Mar 27 07:53:33.566384 2026] [:error] [pid 27851:tid 27878] [client 20.19.177.219:6923] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tt.php"] [unique_id "acXG_XR2ccxe3RMCLbowlgAAANQ"]
[Fri Mar 27 07:53:34.250787 2026] [:error] [pid 27851:tid 27882] [client 20.19.177.219:53429] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tt.php"] [unique_id "acXG_nR2ccxe3RMCLbowmAAAANg"]
[Fri Mar 27 07:53:35.543876 2026] [:error] [pid 4341:tid 4363] [client 20.19.177.219:6506] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tt.php"] [unique_id "acXG_-KJWrNB5dMlERE4UwAAAZQ"]
[Fri Mar 27 07:53:36.598796 2026] [:error] [pid 4293:tid 4304] [client 20.19.177.219:6345] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maul.php"] [unique_id "acXHAJLjeJUC3OKtEx-jYgAAAUk"]
[Fri Mar 27 07:53:37.518398 2026] [:error] [pid 4341:tid 4361] [client 20.19.177.219:53384] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maul.php"] [unique_id "acXHAeKJWrNB5dMlERE4VgAAAZI"]
[Fri Mar 27 07:53:38.514055 2026] [:error] [pid 63897:tid 63900] [client 20.19.177.219:53424] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maul.php"] [unique_id "acXHAmVSkmYmLu7ycYgreQAAAQE"]
[Fri Mar 27 07:53:39.082557 2026] [:error] [pid 27743:tid 27787] [client 20.19.177.219:54338] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/maul.php"] [unique_id "acXHAyA46UYYLqzw99APUwAAABc"]
[Fri Mar 27 07:53:39.664374 2026] [:error] [pid 27851:tid 27872] [client 20.19.177.219:6943] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acXHA3R2ccxe3RMCLbownwAAAM4"]
[Fri Mar 27 07:53:40.397130 2026] [:error] [pid 63897:tid 63922] [client 20.19.177.219:6608] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acXHBGVSkmYmLu7ycYgrgwAAARc"]
[Fri Mar 27 07:53:41.552049 2026] [:error] [pid 63897:tid 63905] [client 20.19.177.219:52917] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acXHBWVSkmYmLu7ycYgrlQAAAQY"]
[Fri Mar 27 07:53:42.633378 2026] [:error] [pid 63897:tid 63912] [client 20.19.177.219:53390] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/5b9ac.php"] [unique_id "acXHBmVSkmYmLu7ycYgrnwAAAQ0"]
[Fri Mar 27 07:53:45.921939 2026] [:error] [pid 4293:tid 4296] [client 20.19.177.219:53405] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acXHCZLjeJUC3OKtEx-jfgAAAUE"]
[Fri Mar 27 07:53:47.357171 2026] [:error] [pid 4341:tid 4351] [client 20.19.177.219:6387] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acXHC-KJWrNB5dMlERE4YwAAAYg"]
[Fri Mar 27 07:53:54.014435 2026] [:error] [pid 4293:tid 4295] [client 20.19.177.219:6932] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acXHEpLjeJUC3OKtEx-joAAAAUA"]
[Fri Mar 27 07:53:55.040181 2026] [:error] [pid 63897:tid 63900] [client 20.19.177.219:52919] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/hehe.php"] [unique_id "acXHE2VSkmYmLu7ycYgrrAAAAQE"]
[Fri Mar 27 07:53:56.197809 2026] [:error] [pid 63897:tid 63912] [client 20.19.177.219:51816] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acXHFGVSkmYmLu7ycYgrtQAAAQ0"]
[Fri Mar 27 07:53:56.805168 2026] [:error] [pid 4293:tid 4299] [client 20.19.177.219:52914] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acXHFJLjeJUC3OKtEx-jrAAAAUQ"]
[Fri Mar 27 07:53:57.730076 2026] [:error] [pid 27749:tid 27810] [client 20.19.177.219:52120] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acXHFcEqyoMni2Q6_X5zBgAAAFM"]
[Fri Mar 27 07:53:58.334107 2026] [:error] [pid 4293:tid 4299] [client 20.19.177.219:51825] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/6kDPjgFTmvS.php"] [unique_id "acXHFpLjeJUC3OKtEx-jtQAAAUQ"]
[Fri Mar 27 07:53:59.032738 2026] [:error] [pid 27851:tid 27862] [client 20.19.177.219:54344] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/varb.php"] [unique_id "acXHF3R2ccxe3RMCLbowvgAAAMQ"]
[Fri Mar 27 07:54:00.078857 2026] [:error] [pid 4293:tid 4305] [client 20.19.177.219:51799] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/varb.php"] [unique_id "acXHGJLjeJUC3OKtEx-jvQAAAUo"]
[Fri Mar 27 07:54:00.711300 2026] [:error] [pid 4293:tid 4309] [client 20.19.177.219:6373] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/varb.php"] [unique_id "acXHGJLjeJUC3OKtEx-jwgAAAU4"]
[Fri Mar 27 07:54:01.424575 2026] [:error] [pid 63897:tid 63902] [client 20.19.177.219:51789] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/varb.php"] [unique_id "acXHGWVSkmYmLu7ycYgrtwAAAQM"]
[Fri Mar 27 07:54:02.099468 2026] [:error] [pid 4293:tid 4304] [client 20.19.177.219:53416] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lm15.php"] [unique_id "acXHGpLjeJUC3OKtEx-jxAAAAUk"]
[Fri Mar 27 07:54:24.962720 2026] [:error] [pid 4293:tid 4318] [client 20.19.177.219:6955] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/b.php"] [unique_id "acXHMJLjeJUC3OKtEx-kAwAAAVc"]
[Fri Mar 27 07:54:26.270589 2026] [:error] [pid 4293:tid 4301] [client 20.19.177.219:6513] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/b.php"] [unique_id "acXHMpLjeJUC3OKtEx-kCwAAAUY"]
[Fri Mar 27 07:54:27.540928 2026] [:error] [pid 4293:tid 4306] [client 20.19.177.219:53395] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/b.php"] [unique_id "acXHM5LjeJUC3OKtEx-kFAAAAUs"]
[Fri Mar 27 07:54:28.560394 2026] [:error] [pid 63897:tid 63907] [client 20.19.177.219:6920] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/b.php"] [unique_id "acXHNGVSkmYmLu7ycYgr8gAAAQg"]
[Fri Mar 27 07:54:29.766786 2026] [:error] [pid 4293:tid 4313] [client 20.19.177.219:6508] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws49.php"] [unique_id "acXHNZLjeJUC3OKtEx-kGQAAAVI"]
[Fri Mar 27 07:54:31.814503 2026] [:error] [pid 27851:tid 27867] [client 20.19.177.219:6389] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws49.php"] [unique_id "acXHN3R2ccxe3RMCLbow5gAAAMk"]
[Fri Mar 27 07:54:33.195604 2026] [:error] [pid 63897:tid 63914] [client 20.19.177.219:6347] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws49.php"] [unique_id "acXHOWVSkmYmLu7ycYgsAgAAAQ8"]
[Fri Mar 27 07:54:33.986914 2026] [:error] [pid 63897:tid 63911] [client 20.19.177.219:6636] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws49.php"] [unique_id "acXHOWVSkmYmLu7ycYgsBQAAAQw"]
[Fri Mar 27 07:54:34.629475 2026] [:error] [pid 63897:tid 63915] [client 20.19.177.219:54390] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog-header.php"] [unique_id "acXHOmVSkmYmLu7ycYgsCwAAARA"]
[Fri Mar 27 07:54:35.272722 2026] [:error] [pid 63897:tid 63921] [client 20.19.177.219:6950] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog-header.php"] [unique_id "acXHO2VSkmYmLu7ycYgsEAAAARY"]
[Fri Mar 27 07:54:36.189759 2026] [:error] [pid 4341:tid 4356] [client 20.19.177.219:53378] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog-header.php"] [unique_id "acXHPOKJWrNB5dMlERE4hgAAAY0"]
[Fri Mar 27 07:54:37.010613 2026] [:error] [pid 27851:tid 27881] [client 20.19.177.219:6598] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blog-header.php"] [unique_id "acXHPXR2ccxe3RMCLbow8gAAANc"]
[Fri Mar 27 07:54:37.683384 2026] [:error] [pid 27750:tid 27818] [client 20.19.177.219:6624] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acXHPYaSil5rd17ieLxQBQAAAIA"]
[Fri Mar 27 07:54:38.381472 2026] [:error] [pid 4293:tid 4302] [client 20.19.177.219:52907] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acXHPpLjeJUC3OKtEx-kLAAAAUc"]
[Fri Mar 27 07:54:39.386169 2026] [:error] [pid 63897:tid 63919] [client 20.19.177.219:7021] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acXHP2VSkmYmLu7ycYgsGAAAARQ"]
[Fri Mar 27 07:54:39.909468 2026] [:error] [pid 63897:tid 63913] [client 20.19.177.219:6515] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "acXHP2VSkmYmLu7ycYgsGQAAAQ4"]
[Fri Mar 27 07:54:40.600630 2026] [:error] [pid 63897:tid 63904] [client 20.19.177.219:52882] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gfd.php"] [unique_id "acXHQGVSkmYmLu7ycYgsHwAAAQU"]
[Fri Mar 27 07:54:41.380564 2026] [:error] [pid 4341:tid 4362] [client 20.19.177.219:54365] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gfd.php"] [unique_id "acXHQeKJWrNB5dMlERE4kQAAAZM"]
[Fri Mar 27 07:54:41.944513 2026] [:error] [pid 27743:tid 27781] [client 20.19.177.219:53412] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gfd.php"] [unique_id "acXHQSA46UYYLqzw99APZAAAABE"]
[Fri Mar 27 07:54:42.989302 2026] [:error] [pid 4293:tid 4302] [client 20.19.177.219:6942] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gfd.php"] [unique_id "acXHQpLjeJUC3OKtEx-kNgAAAUc"]
[Fri Mar 27 07:54:43.832474 2026] [:error] [pid 63897:tid 63900] [client 20.19.177.219:6371] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/callback.php"] [unique_id "acXHQ2VSkmYmLu7ycYgsJgAAAQE"]
[Fri Mar 27 07:54:44.640007 2026] [:error] [pid 4293:tid 4319] [client 20.19.177.219:51791] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/callback.php"] [unique_id "acXHRJLjeJUC3OKtEx-kPgAAAVg"]
[Fri Mar 27 07:54:45.579400 2026] [:error] [pid 4293:tid 4296] [client 20.19.177.219:6479] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/callback.php"] [unique_id "acXHRZLjeJUC3OKtEx-kRQAAAUE"]
[Fri Mar 27 07:54:46.592959 2026] [:error] [pid 27749:tid 27791] [client 20.19.177.219:6620] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/callback.php"] [unique_id "acXHRsEqyoMni2Q6_X5zGgAAAEA"]
[Fri Mar 27 07:54:47.569546 2026] [:error] [pid 4341:tid 4352] [client 20.19.177.219:7060] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file.php"] [unique_id "acXHR-KJWrNB5dMlERE4ngAAAYk"]
[Fri Mar 27 07:54:48.890749 2026] [:error] [pid 63897:tid 63908] [client 20.19.177.219:6957] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file.php"] [unique_id "acXHSGVSkmYmLu7ycYgsMgAAAQk"]
[Fri Mar 27 07:54:49.595950 2026] [:error] [pid 4341:tid 4358] [client 20.19.177.219:51800] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file.php"] [unique_id "acXHSeKJWrNB5dMlERE4oAAAAY8"]
[Fri Mar 27 07:54:50.436546 2026] [:error] [pid 4293:tid 4314] [client 20.19.177.219:6380] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file.php"] [unique_id "acXHSpLjeJUC3OKtEx-kWwAAAVM"]
[Fri Mar 27 07:54:51.377438 2026] [:error] [pid 27750:tid 27836] [client 20.19.177.219:6634] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acXHS4aSil5rd17ieLxQGAAAAJI"]
[Fri Mar 27 07:54:52.274171 2026] [:error] [pid 4293:tid 4302] [client 20.19.177.219:7068] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acXHTJLjeJUC3OKtEx-kYgAAAUc"]
[Fri Mar 27 07:54:53.341823 2026] [:error] [pid 4341:tid 4355] [client 20.19.177.219:53378] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acXHTeKJWrNB5dMlERE4qgAAAYw"]
[Fri Mar 27 07:54:54.182158 2026] [:error] [pid 4293:tid 4295] [client 20.19.177.219:6516] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "acXHTpLjeJUC3OKtEx-kZQAAAUA"]
[Fri Mar 27 07:54:55.037831 2026] [:error] [pid 63897:tid 63903] [client 20.19.177.219:7153] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acXHT2VSkmYmLu7ycYgsRAAAAQQ"]
[Fri Mar 27 07:54:55.740414 2026] [:error] [pid 4341:tid 4351] [client 20.19.177.219:54378] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acXHT-KJWrNB5dMlERE4vwAAAYg"]
[Fri Mar 27 07:54:56.327656 2026] [:error] [pid 4341:tid 4345] [client 20.19.177.219:53387] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acXHUOKJWrNB5dMlERE4xQAAAYI"]
[Fri Mar 27 07:54:57.492758 2026] [:error] [pid 4293:tid 4314] [client 20.19.177.219:7073] [client 20.19.177.219] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-blogs.php"] [unique_id "acXHUZLjeJUC3OKtEx-kbgAAAVM"]
[Fri Mar 27 11:15:26.849798 2026] [:error] [pid 27749:tid 27809] [client 103.199.205.68:14201] [client 103.199.205.68] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.199.205.68, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acX2TsEqyoMni2Q6_X6XyAAAAFI"]
[Fri Mar 27 11:15:56.611684 2026] [:error] [pid 63897:tid 63912] [client 61.1.116.149:11024] [client 61.1.116.149] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 61.1.116.149, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acX2bGVSkmYmLu7ycYidSgAAAQ0"]
[Fri Mar 27 15:57:05.126487 2026] [:error] [pid 4293:tid 4309] [client 85.203.23.19:49731] [client 85.203.23.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/config.php"] [unique_id "acY4UZLjeJUC3OKtEx_YrQAAAU4"]
[Fri Mar 27 15:57:06.300858 2026] [:error] [pid 27749:tid 27815] [client 85.203.23.2:43357] [client 85.203.23.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/header.php"] [unique_id "acY4UsEqyoMni2Q6_X7K6gAAAFg"]
[Fri Mar 27 15:57:06.501187 2026] [:error] [pid 4293:tid 4299] [client 85.203.23.16:35167] [client 85.203.23.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/system_core.php"] [unique_id "acY4UpLjeJUC3OKtEx_YtwAAAUQ"]
[Fri Mar 27 15:57:09.980404 2026] [:error] [pid 4293:tid 4306] [client 85.203.23.2:46127] [client 85.203.23.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "acY4VZLjeJUC3OKtEx_YyAAAAUs"]
[Fri Mar 27 15:57:12.897842 2026] [:error] [pid 27743:tid 27766] [client 85.203.23.32:42567] [client 85.203.23.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "acY4WCA46UYYLqzw99Bj8QAAAAI"]
[Fri Mar 27 15:57:16.409323 2026] [:error] [pid 27743:tid 27774] [client 85.203.23.10:22375] [client 85.203.23.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/speculative8.php"] [unique_id "acY4XCA46UYYLqzw99BkFAAAAAo"]
[Fri Mar 27 15:57:22.130511 2026] [:error] [pid 4341:tid 4353] [client 85.203.23.5:56287] [client 85.203.23.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "acY4YuKJWrNB5dMlERFAEAAAAYo"]
[Fri Mar 27 15:57:22.333963 2026] [:error] [pid 27749:tid 27796] [client 85.203.23.51:36543] [client 85.203.23.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/updraft/plugins-old/updraftplus/vendor/team-updraft/"] [unique_id "acY4YsEqyoMni2Q6_X7K_wAAAEU"]
[Fri Mar 27 15:57:58.836062 2026] [:error] [pid 4293:tid 4297] [client 85.203.23.9:64989] [client 85.203.23.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "acY4hpLjeJUC3OKtEx_ZbAAAAUI"]
[Fri Mar 27 15:58:26.798678 2026] [:error] [pid 27750:tid 27823] [client 85.203.23.37:26069] [client 85.203.23.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/themes/about.php"] [unique_id "acY4ooaSil5rd17ieLy_RwAAAIU"]
[Fri Mar 27 15:58:56.744496 2026] [:error] [pid 63897:tid 63915] [client 85.203.23.4:21661] [client 85.203.23.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/k.php"] [unique_id "acY4wGVSkmYmLu7ycYgFigAAARA"]
[Fri Mar 27 15:59:06.041620 2026] [:error] [pid 4293:tid 4296] [client 85.203.23.16:47819] [client 85.203.23.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "acY4ypLjeJUC3OKtEx_aBAAAAUE"]
[Fri Mar 27 15:59:08.260457 2026] [:error] [pid 27743:tid 27774] [client 85.203.23.4:62669] [client 85.203.23.4] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 85.203.23.4, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acY4zCA46UYYLqzw99Bl_wAAAAo"]
[Fri Mar 27 15:59:49.224821 2026] [autoindex:error] [pid 27743:tid 27769] [client 85.203.23.4:62669] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Fri Mar 27 15:59:51.252678 2026] [:error] [pid 27743:tid 27781] [client 85.203.23.4:62669] [client 85.203.23.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/themes.php"] [unique_id "acY49yA46UYYLqzw99BmtwAAABE"]
[Fri Mar 27 15:59:51.628895 2026] [:error] [pid 4341:tid 4353] [client 85.203.23.21:35773] [client 85.203.23.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acY49-KJWrNB5dMlERFBVwAAAYo"]
[Fri Mar 27 15:59:51.813624 2026] [:error] [pid 4293:tid 4306] [client 85.203.23.8:35017] [client 85.203.23.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/chosen.php"] [unique_id "acY495LjeJUC3OKtEx_aewAAAUs"]
[Fri Mar 27 15:59:52.003620 2026] [:error] [pid 4341:tid 4362] [client 85.203.23.11:29921] [client 85.203.23.11] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/network/about.php"] [unique_id "acY4-OKJWrNB5dMlERFBWAAAAZM"]
[Fri Mar 27 15:59:56.189194 2026] [:error] [pid 4293:tid 4314] [client 85.203.23.40:34243] [client 85.203.23.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "acY4_JLjeJUC3OKtEx_akQAAAVM"]
[Fri Mar 27 16:00:01.239056 2026] [:error] [pid 63897:tid 63914] [client 85.203.23.52:39387] [client 85.203.23.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/about.php"] [unique_id "acY5AWVSkmYmLu7ycYgF4AAAAQ8"]
[Fri Mar 27 16:00:01.453572 2026] [:error] [pid 4341:tid 4351] [client 85.203.23.43:63373] [client 85.203.23.43] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "acY5AeKJWrNB5dMlERFBcQAAAYg"]
[Fri Mar 27 16:00:07.305155 2026] [:error] [pid 27749:tid 27809] [client 85.203.23.8:48309] [client 85.203.23.8] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "acY5B8EqyoMni2Q6_X7LZQAAAFI"]
[Fri Mar 27 16:00:07.502033 2026] [:error] [pid 27851:tid 27862] [client 85.203.23.16:39607] [client 85.203.23.16] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/coffee/"] [unique_id "acY5B3R2ccxe3RMCLbq2ngAAAMQ"]
[Fri Mar 27 16:00:07.691728 2026] [:error] [pid 4293:tid 4301] [client 85.203.23.29:63487] [client 85.203.23.29] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/"] [unique_id "acY5B5LjeJUC3OKtEx_arwAAAUY"]
[Fri Mar 27 16:00:11.196831 2026] [:error] [pid 27750:tid 27829] [client 85.203.23.3:64899] [client 85.203.23.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "acY5C4aSil5rd17ieLy_swAAAIs"]
[Fri Mar 27 16:00:12.535326 2026] [:error] [pid 4293:tid 4314] [client 85.203.23.30:34793] [client 85.203.23.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-conflg.php"] [unique_id "acY5DJLjeJUC3OKtEx_atQAAAVM"]
[Fri Mar 27 16:00:15.764057 2026] [:error] [pid 4293:tid 4315] [client 85.203.23.22:30211] [client 85.203.23.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/chosen.php"] [unique_id "acY5D5LjeJUC3OKtEx_avQAAAVQ"]
[Fri Mar 27 16:00:23.227814 2026] [:error] [pid 4293:tid 4315] [client 85.203.23.33:23545] [client 85.203.23.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/joker.php"] [unique_id "acY5F5LjeJUC3OKtEx_a3QAAAVQ"]
[Fri Mar 27 16:00:27.862930 2026] [:error] [pid 4293:tid 4306] [client 85.203.23.17:28591] [client 85.203.23.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/joker.php"] [unique_id "acY5G5LjeJUC3OKtEx_a8QAAAUs"]
[Fri Mar 27 16:00:42.560637 2026] [:error] [pid 4341:tid 4357] [client 85.203.23.3:59535] [client 85.203.23.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "acY5KuKJWrNB5dMlERFB1QAAAY4"]
[Fri Mar 27 16:00:50.808120 2026] [:error] [pid 27851:tid 27864] [client 85.203.23.41:45753] [client 85.203.23.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "acY5MnR2ccxe3RMCLbq22gAAAMY"]
[Fri Mar 27 16:01:01.080861 2026] [:error] [pid 4293:tid 4312] [client 85.203.23.13:40217] [client 85.203.23.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-text-cron.php"] [unique_id "acY5PZLjeJUC3OKtEx_bSAAAAVE"]
[Fri Mar 27 16:01:05.352988 2026] [:error] [pid 4341:tid 4360] [client 85.203.23.34:42705] [client 85.203.23.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/post-template-path.php"] [unique_id "acY5QeKJWrNB5dMlERFB8wAAAZE"]
[Fri Mar 27 16:01:05.536631 2026] [:error] [pid 27750:tid 27823] [client 85.203.23.34:37923] [client 85.203.23.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/plex1.php"] [unique_id "acY5QYaSil5rd17ieLy_2wAAAIU"]
[Fri Mar 27 16:01:11.148931 2026] [:error] [pid 27743:tid 27769] [client 85.203.23.4:25057] [client 85.203.23.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/nextpage/wp-cron.php"] [unique_id "acY5RyA46UYYLqzw99Bn3AAAAAU"]
[Fri Mar 27 16:01:14.253403 2026] [:error] [pid 27743:tid 27786] [client 85.203.23.11:65009] [client 85.203.23.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/button/admiin.php"] [unique_id "acY5SiA46UYYLqzw99Bn9AAAABY"]
[Fri Mar 27 16:01:27.441006 2026] [:error] [pid 27750:tid 27839] [client 85.203.23.36:48527] [client 85.203.23.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/plugins/users.php"] [unique_id "acY5V4aSil5rd17ieLy_-QAAAJU"]
[Fri Mar 27 16:01:42.820499 2026] [:error] [pid 4293:tid 4313] [client 85.203.23.35:33731] [client 85.203.23.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-cron.php"] [unique_id "acY5ZpLjeJUC3OKtEx_bzAAAAVI"]
[Fri Mar 27 16:01:43.014587 2026] [:error] [pid 4341:tid 4353] [client 85.203.23.28:39945] [client 85.203.23.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/plugins/api.php"] [unique_id "acY5Z-KJWrNB5dMlERFCEAAAAYo"]
[Fri Mar 27 16:01:43.207267 2026] [:error] [pid 27743:tid 27785] [client 85.203.23.10:39463] [client 85.203.23.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/panel.php"] [unique_id "acY5ZyA46UYYLqzw99BosQAAABU"]
[Fri Mar 27 16:01:44.384878 2026] [:error] [pid 27750:tid 27839] [client 85.203.23.5:27405] [client 85.203.23.5] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/tx1.php"] [unique_id "acY5aIaSil5rd17ieLzAAgAAAJU"]
[Fri Mar 27 16:01:45.512756 2026] [:error] [pid 4293:tid 4307] [client 85.203.23.42:58465] [client 85.203.23.42] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/autoload_classmap.php"] [unique_id "acY5aZLjeJUC3OKtEx_b0QAAAUw"]
[Fri Mar 27 16:01:45.708303 2026] [:error] [pid 27750:tid 27841] [client 85.203.23.38:30131] [client 85.203.23.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "acY5aYaSil5rd17ieLzAAwAAAJc"]
[Fri Mar 27 16:01:49.307432 2026] [:error] [pid 27749:tid 27798] [client 85.203.23.37:24113] [client 85.203.23.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh.php"] [unique_id "acY5bcEqyoMni2Q6_X7LzQAAAEc"]
[Fri Mar 27 16:01:57.191693 2026] [:error] [pid 4293:tid 4311] [client 85.203.23.13:38703] [client 85.203.23.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/author-template-object.php"] [unique_id "acY5dZLjeJUC3OKtEx_cDAAAAVA"]
[Fri Mar 27 16:01:57.411229 2026] [:error] [pid 27743:tid 27786] [client 85.203.23.9:41395] [client 85.203.23.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/doc.php"] [unique_id "acY5dSA46UYYLqzw99Bo2gAAABY"]
[Fri Mar 27 16:01:57.620731 2026] [:error] [pid 27743:tid 27776] [client 85.203.23.31:58897] [client 85.203.23.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/vendor/about.php"] [unique_id "acY5dSA46UYYLqzw99Bo2wAAAAw"]
[Fri Mar 27 16:01:57.808001 2026] [:error] [pid 27743:tid 27787] [client 85.203.23.13:28315] [client 85.203.23.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Exception/177.php"] [unique_id "acY5dSA46UYYLqzw99Bo3gAAABc"]
[Fri Mar 27 16:01:57.997268 2026] [:error] [pid 4341:tid 4357] [client 85.203.23.39:59577] [client 85.203.23.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/site-title-restful.php"] [unique_id "acY5deKJWrNB5dMlERFCOAAAAY4"]
[Fri Mar 27 16:01:58.186579 2026] [:error] [pid 4341:tid 4360] [client 85.203.23.43:23209] [client 85.203.23.43] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/fonts/poppins/wp-login.php"] [unique_id "acY5duKJWrNB5dMlERFCOQAAAZE"]
[Fri Mar 27 16:01:58.393795 2026] [:error] [pid 27851:tid 27867] [client 85.203.23.35:32615] [client 85.203.23.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/namespaced/Core/goods.php"] [unique_id "acY5dnR2ccxe3RMCLbq3BQAAAMk"]
[Fri Mar 27 16:02:23.236118 2026] [:error] [pid 63897:tid 63918] [client 85.203.23.45:36917] [client 85.203.23.45] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\/lib\\\\/php\\\\/connector\\\\.minimal\\\\.php$" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/27_Apps_WPPlugin.conf"] [line "6778"] [id "234930"] [rev "2"] [msg "COMODO WAF: File upload vulnerability in the file manager plugin before 6.9 for WordPress (CVE-2020-25213)||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WPPlugin"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "acY5j2VSkmYmLu7ycYgHSAAAARM"]
[Fri Mar 27 16:02:28.264087 2026] [:error] [pid 63897:tid 63921] [client 85.203.23.45:36917] [client 85.203.23.45] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/latest-posts.php"] [unique_id "acY5lGVSkmYmLu7ycYgHWAAAARY"]
[Fri Mar 27 16:02:28.450662 2026] [:error] [pid 63897:tid 63907] [client 85.203.23.14:26923] [client 85.203.23.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/rss.php"] [unique_id "acY5lGVSkmYmLu7ycYgHWQAAAQg"]
[Fri Mar 27 16:02:28.645098 2026] [:error] [pid 63897:tid 63903] [client 85.203.23.41:45163] [client 85.203.23.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/search.php"] [unique_id "acY5lGVSkmYmLu7ycYgHWwAAAQQ"]
[Fri Mar 27 16:02:28.846940 2026] [:error] [pid 4293:tid 4312] [client 85.203.23.41:47877] [client 85.203.23.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/post-comments.php"] [unique_id "acY5lJLjeJUC3OKtEx_cfwAAAVE"]
[Fri Mar 27 16:02:50.629633 2026] [:error] [pid 4293:tid 4312] [client 85.203.23.51:40431] [client 85.203.23.51] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/system/engine/loader.php"] [unique_id "acY5qpLjeJUC3OKtEx_c4wAAAVE"]
[Fri Mar 27 21:22:31.960363 2026] [:error] [pid 27743:tid 27787] [client 180.243.1.167:58466] [client 180.243.1.167] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.243.1.167, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acaElyA46UYYLqzw99ADiAAAABc"]
[Fri Mar 27 22:57:07.671067 2026] [:error] [pid 54663:tid 54689] [client 217.216.37.53:57138] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "acaawxUtStIXFk9WHe3gLwAAAdc"]
[Fri Mar 27 22:57:07.883326 2026] [:error] [pid 54663:tid 54680] [client 217.216.37.53:50094] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "acaawxUtStIXFk9WHe3gNAAAAc4"]
[Fri Mar 27 22:57:08.095324 2026] [:error] [pid 27749:tid 27815] [client 217.216.37.53:63553] [client 217.216.37.53] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/media/system/js/core.js"] [unique_id "acaaxMEqyoMni2Q6_X4dvwAAAFg"]
[Sat Mar 28 03:13:47.841527 2026] [:error] [pid 51655:tid 51678] [client 88.180.187.72:35648] [client 88.180.187.72] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.180.187.72, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acbW634PB5Q8y9C2Z9XXqgAAAVU"]
[Sat Mar 28 09:13:59.677110 2026] [:error] [pid 64860:tid 64924] [client 20.53.228.80:13639] [client 20.53.228.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.53.228.80, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "accrVxkU3N0pg_4aEL8NAgAAAFA"]
[Sat Mar 28 09:13:59.872046 2026] [:error] [pid 64860:tid 64929] [client 20.53.228.80:13639] [client 20.53.228.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.53.228.80, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "accrVxkU3N0pg_4aEL8NDAAAAFU"]
[Sat Mar 28 09:14:00.153768 2026] [:error] [pid 64860:tid 64930] [client 20.53.228.80:13639] [client 20.53.228.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/1.php"] [unique_id "accrWBkU3N0pg_4aEL8NGgAAAFY"]
[Sat Mar 28 09:14:00.226871 2026] [:error] [pid 43547:tid 43550] [client 20.53.228.80:13668] [client 20.53.228.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/photo.php"] [unique_id "accrWD4ZEfdetXP-9aC76gAAAgE"]
[Sat Mar 28 09:32:53.310333 2026] [:error] [pid 64860:tid 64923] [client 20.220.9.32:32649] [client 20.220.9.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "accvxRkU3N0pg_4aEL8WtgAAAE8"]
[Sat Mar 28 09:32:54.731164 2026] [:error] [pid 34631:tid 34665] [client 20.220.9.32:32739] [client 20.220.9.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "accvxjtzjMMS6kojpeRWqgAAAcU"]
[Sat Mar 28 09:32:56.183926 2026] [:error] [pid 43578:tid 43588] [client 20.220.9.32:32760] [client 20.220.9.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "accvyHNG2YdGm41aN8L19gAAAkc"]
[Sat Mar 28 09:32:57.607593 2026] [:error] [pid 43547:tid 43552] [client 20.220.9.32:32652] [client 20.220.9.32] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "accvyT4ZEfdetXP-9aC99wAAAgM"]
[Sat Mar 28 13:21:59.251857 2026] [:error] [pid 43547:tid 43565] [client 49.43.133.19:62482] [client 49.43.133.19] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 49.43.133.19, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acdldz4ZEfdetXP-9aDUOgAAAhA"]
[Sat Mar 28 20:23:31.776204 2026] [:error] [pid 64861:tid 64953] [client 109.132.10.49:62924] [client 109.132.10.49] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 109.132.10.49, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acfIQ-xK22_lUN2kvnVg5AAAAJI"]
[Sat Mar 28 21:12:19.823441 2026] [:error] [pid 34631:tid 34668] [client 104.28.161.186:53143] [client 104.28.161.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/style.php"] [unique_id "acfTsztzjMMS6kojpeRWDQAAAcg"]
[Sat Mar 28 23:55:18.826305 2026] [:error] [pid 2877:tid 2894] [client 150.228.3.245:14565] [client 150.228.3.245] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.228.3.245, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acf55rgM4xL1Xj409YQfXgAAAQ8"]
[Sun Mar 29 03:10:07.224784 2026] [:error] [pid 60346:tid 60366] [client 20.122.187.158:25334] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acgnj3VrXSgLxlxLi9BdMwAAAQ8"]
[Sun Mar 29 03:10:07.646909 2026] [:error] [pid 11588:tid 11590] [client 20.122.187.158:25325] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acgnjwhH5525WHuzKfpzhQAAAUA"]
[Sun Mar 29 03:10:08.146357 2026] [:error] [pid 39427:tid 39453] [client 20.122.187.158:25338] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acgnkFvLf0RDUqcYq-ZihwAAABU"]
[Sun Mar 29 03:10:08.671447 2026] [:error] [pid 11588:tid 11596] [client 20.122.187.158:25276] [client 20.122.187.158] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acgnkAhH5525WHuzKfpzjwAAAUY"]
[Sun Mar 29 03:12:26.410699 2026] [:error] [pid 11588:tid 11612] [client 20.212.0.99:10964] [client 20.212.0.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "acgoGghH5525WHuzKfp1fgAAAVY"]
[Sun Mar 29 13:13:17.531692 2026] [:error] [pid 23167:tid 23180] [client 174.234.135.221:2690] [client 174.234.135.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 174.234.135.221, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aci07RIAHJCFaHff3_cJGgAAAco"]
[Sun Mar 29 17:07:50.215559 2026] [:error] [pid 23284:tid 23288] [client 188.25.252.114:63636] [client 188.25.252.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 188.25.252.114, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acjr5ozBujdPHsq7wyQDlQAAAoI"]
[Sun Mar 29 22:14:31.024905 2026] [:error] [pid 32257:tid 32340] [client 138.226.240.135:60946] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "ackzxyE3TArOFrUtgWo_dQAAAJY"]
[Sun Mar 29 22:14:31.531857 2026] [:error] [pid 32257:tid 32325] [client 138.226.240.135:34726] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "ackzxyE3TArOFrUtgWo_dwAAAIc"]
[Sun Mar 29 22:14:32.037998 2026] [:error] [pid 23284:tid 23300] [client 138.226.240.135:60960] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production"] [unique_id "ackzyIzBujdPHsq7wySubAAAAo4"]
[Sun Mar 29 22:14:32.506361 2026] [:error] [pid 23284:tid 23292] [client 138.226.240.135:34740] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production"] [unique_id "ackzyIzBujdPHsq7wySucAAAAoY"]
[Sun Mar 29 22:14:33.051976 2026] [:error] [pid 32257:tid 32327] [client 138.226.240.135:60964] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.staging"] [unique_id "ackzySE3TArOFrUtgWo_egAAAIk"]
[Sun Mar 29 22:14:33.506884 2026] [:error] [pid 32257:tid 32323] [client 138.226.240.135:34750] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.staging"] [unique_id "ackzySE3TArOFrUtgWo_fgAAAIU"]
[Sun Mar 29 22:14:34.093489 2026] [:error] [pid 23168:tid 23214] [client 138.226.240.135:60972] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/api/.env"] [unique_id "ackzymP8p0yRL8ot_2-jNwAAAhE"]
[Sun Mar 29 22:14:34.537602 2026] [:error] [pid 23168:tid 23207] [client 138.226.240.135:34754] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/api/.env"] [unique_id "ackzymP8p0yRL8ot_2-jOwAAAgo"]
[Sun Mar 29 22:14:35.052831 2026] [:error] [pid 23168:tid 23216] [client 138.226.240.135:45528] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/admin/.env"] [unique_id "ackzy2P8p0yRL8ot_2-jPQAAAhM"]
[Sun Mar 29 22:14:35.573015 2026] [:error] [pid 23168:tid 23201] [client 138.226.240.135:55482] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/admin/.env"] [unique_id "ackzy2P8p0yRL8ot_2-jPwAAAgQ"]
[Sun Mar 29 22:14:36.087650 2026] [:error] [pid 32255:tid 32310] [client 138.226.240.135:45538] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.save"] [unique_id "ackzzGnfn-AtRoMbquz3GgAAAFM"]
[Sun Mar 29 22:14:36.767796 2026] [:error] [pid 32255:tid 32298] [client 138.226.240.135:55486] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.save"] [unique_id "ackzzGnfn-AtRoMbquz3IQAAAEc"]
[Sun Mar 29 22:14:37.273250 2026] [:error] [pid 32255:tid 32312] [client 138.226.240.135:45548] [client 138.226.240.135] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/app/.env"] [unique_id "ackzzWnfn-AtRoMbquz3JgAAAFU"]
[Sun Mar 29 23:33:47.634535 2026] [:error] [pid 23168:tid 23206] [client 80.62.117.32:54330] [client 80.62.117.32] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 80.62.117.32, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aclGW2P8p0yRL8ot_2-_WwAAAgk"]
[Mon Mar 30 03:03:47.986182 2026] [:error] [pid 32255:tid 32313] [client 40.75.84.21:64831] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acl3k2nfn-AtRoMbqux-dQAAAFY"]
[Mon Mar 30 03:03:49.977491 2026] [:error] [pid 32255:tid 32291] [client 40.75.84.21:64274] [client 40.75.84.21] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acl3lWnfn-AtRoMbqux-fgAAAEA"]
[Mon Mar 30 04:32:30.586325 2026] [:error] [pid 4040:tid 4109] [client 181.115.120.139:37584] [client 181.115.120.139] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.115.120.139, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acmMXgxlbJV8kpOpFvZKpwAAAIE"]
[Mon Mar 30 11:07:48.224373 2026] [:error] [pid 35343:tid 35366] [client 185.198.240.62:22369] [client 185.198.240.62] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "acnpBKP5HurqmbvwN-Jd_QAAABU"]
[Mon Mar 30 13:44:08.961913 2026] [:error] [pid 35249:tid 35284] [client 104.224.85.167:34588] [client 104.224.85.167] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "acoNqCqCKiTq85d6rgAxYgAAAIA"]
[Mon Mar 30 20:14:44.938815 2026] [:error] [pid 35343:tid 35359] [client 94.110.159.107:16867] [client 94.110.159.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 94.110.159.107, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acppNKP5HurqmbvwN-IuzAAAAA4"]
[Mon Mar 30 20:17:10.819945 2026] [:error] [pid 50663:tid 50682] [client 103.92.212.22:55077] [client 103.92.212.22] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.92.212.22, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acppxm28b9DKIAMEdfA3dAAAAZE"]
[Tue Mar 31 01:20:45.955991 2026] [:error] [pid 36672:tid 36816] [client 4.205.8.150:60727] [client 4.205.8.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.205.8.150, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "acqw7bKHDzEfeL3XiLo8rwAAAEk"]
[Tue Mar 31 01:20:49.505922 2026] [:error] [pid 36672:tid 36809] [client 4.205.8.150:60727] [client 4.205.8.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "acqw8bKHDzEfeL3XiLo8wQAAAEI"]
[Tue Mar 31 01:20:52.027352 2026] [:error] [pid 36939:tid 36947] [client 4.205.8.150:60774] [client 4.205.8.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "acqw9MRDKH225Jeq1jc6ZAAAAAY"]
[Tue Mar 31 01:20:53.943277 2026] [:error] [pid 39123:tid 39126] [client 4.205.8.150:60755] [client 4.205.8.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "acqw9SobgVY20PMQKVtTkgAAAQE"]
[Tue Mar 31 01:20:56.488372 2026] [:error] [pid 36672:tid 36826] [client 4.205.8.150:6032] [client 4.205.8.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "acqw-LKHDzEfeL3XiLo80AAAAFM"]
[Tue Mar 31 02:31:51.528767 2026] [:error] [pid 39123:tid 39132] [client 185.238.231.50:28325] [client 185.238.231.50] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.238.231.50, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acrBlyobgVY20PMQKVuYEQAAAQc"]
[Tue Mar 31 03:05:36.520451 2026] [:error] [pid 36939:tid 36944] [client 4.205.8.150:5710] [client 4.205.8.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.205.8.150, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acrJgMRDKH225Jeq1jeFzgAAAAM"]
[Tue Mar 31 03:05:37.358071 2026] [:error] [pid 36939:tid 36942] [client 4.205.8.150:5710] [client 4.205.8.150] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 4.205.8.150, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acrJgcRDKH225Jeq1jeF1QAAAAE"]
[Tue Mar 31 06:37:28.012115 2026] [:error] [pid 18333:tid 18385] [client 15.204.12.43:65509] [client 15.204.12.43] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/composer.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/cidaas-pro-master/composer.json"] [unique_id "acr7KESx2C5hLR0-8dIVtwAAAEY"]
[Tue Mar 31 09:47:55.237543 2026] [:error] [pid 36982:tid 36997] [client 4.204.246.56:22474] [client 4.204.246.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acsny_lMmeoQKN0r_GOrGgAAAMw"]
[Tue Mar 31 09:47:55.650368 2026] [:error] [pid 36982:tid 36986] [client 4.204.246.56:22519] [client 4.204.246.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acsny_lMmeoQKN0r_GOrHAAAAME"]
[Tue Mar 31 09:47:56.064558 2026] [:error] [pid 6548:tid 6552] [client 4.204.246.56:22404] [client 4.204.246.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acsnzLgIz9HgMl9YwE6pwgAAAUI"]
[Tue Mar 31 09:47:56.476127 2026] [:error] [pid 6548:tid 6558] [client 4.204.246.56:22509] [client 4.204.246.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "acsnzLgIz9HgMl9YwE6pyAAAAUg"]
[Tue Mar 31 12:40:01.730180 2026] [:error] [pid 36982:tid 36994] [client 157.230.243.13:50100] [client 157.230.243.13] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "actQIflMmeoQKN0r_GNTlwAAAMk"]
[Tue Mar 31 13:15:34.747825 2026] [:error] [pid 6548:tid 6574] [client 4.204.246.56:52187] [client 4.204.246.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "actYdrgIz9HgMl9YwE42wwAAAVg"]
[Tue Mar 31 13:15:35.165378 2026] [:error] [pid 36891:tid 36947] [client 4.204.246.56:52214] [client 4.204.246.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "actYd5JhiMaJUqoqfl5xXwAAAFc"]
[Tue Mar 31 13:15:35.619298 2026] [:error] [pid 36890:tid 36901] [client 4.204.246.56:52189] [client 4.204.246.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "actYd58FASPd_uH8z7et0gAAAAY"]
[Tue Mar 31 13:15:36.036566 2026] [:error] [pid 41421:tid 41448] [client 4.204.246.56:52220] [client 4.204.246.56] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "actYeBSaDjY9kKFtUQDtCgAAARg"]
[Wed Apr 01 06:36:05.542835 2026] [:error] [pid 24348:tid 24380] [client 181.115.120.128:16086] [client 181.115.120.128] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 181.115.120.128, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "acxMVW0Vs69Y5nF1HA_XhAAAAYE"]
[Wed Apr 01 11:21:28.569896 2026] [:error] [pid 23714:tid 23747] [client 94.72.100.69:64682] [client 94.72.100.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.72.100.69, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "acyPOEHxDDU2ETcG9DSfOAAAAA0"]
[Wed Apr 01 20:33:16.089872 2026] [:error] [pid 8995:tid 9011] [client 39.61.50.145:13483] [client 39.61.50.145] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 39.61.50.145, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ac0QjOonaBjs3qxcRee-wwAAAA0"]
[Wed Apr 01 22:19:46.450929 2026] [:error] [pid 62559:tid 62569] [client 94.72.100.69:57269] [client 94.72.100.69] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 94.72.100.69, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ac0pgi7NKI8IaNKZFIe-RwAAAUg"]
[Wed Apr 01 23:02:06.597341 2026] [:error] [pid 8910:tid 8992] [client 158.158.51.104:34902] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "ac0zbqJZINUcF3tYgEx-mwAAARg"]
[Wed Apr 01 23:02:07.214184 2026] [:error] [pid 17856:tid 17881] [client 158.158.51.104:24675] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "ac0zbz7Idlm5j9frhqR0ZQAAAFc"]
[Wed Apr 01 23:02:08.192503 2026] [:error] [pid 8909:tid 8947] [client 158.158.51.104:24660] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "ac0zcDvP_a0662gDl6AHMAAAAMY"]
[Wed Apr 01 23:02:08.901021 2026] [:error] [pid 8909:tid 8954] [client 158.158.51.104:45217] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ogifomnzqnlvwh5womfjirvaCdefault.php"] [unique_id "ac0zcDvP_a0662gDl6AHNAAAAM0"]
[Wed Apr 01 23:02:09.555793 2026] [:error] [pid 8995:tid 9002] [client 158.158.51.104:37699] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX1.php"] [unique_id "ac0zceonaBjs3qxcRefsHgAAAAQ"]
[Wed Apr 01 23:02:10.153779 2026] [:error] [pid 8909:tid 8941] [client 158.158.51.104:45224] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX1.php"] [unique_id "ac0zcjvP_a0662gDl6AHOgAAAMA"]
[Wed Apr 01 23:02:10.952201 2026] [:error] [pid 8910:tid 8968] [client 158.158.51.104:39875] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX1.php"] [unique_id "ac0zcqJZINUcF3tYgEx-nwAAAQA"]
[Wed Apr 01 23:02:11.800078 2026] [:error] [pid 17856:tid 17881] [client 158.158.51.104:63232] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX1.php"] [unique_id "ac0zcz7Idlm5j9frhqR0cwAAAFc"]
[Wed Apr 01 23:02:12.481366 2026] [:error] [pid 8908:tid 8922] [client 158.158.51.104:45228] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ynjli.php"] [unique_id "ac0zdPkmxtJXGnLdvgDE5gAAAIk"]
[Wed Apr 01 23:02:13.498321 2026] [:error] [pid 8909:tid 8948] [client 158.158.51.104:22026] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ynjli.php"] [unique_id "ac0zdTvP_a0662gDl6AHRQAAAMc"]
[Wed Apr 01 23:02:14.409870 2026] [:error] [pid 8909:tid 8961] [client 158.158.51.104:3125] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ynjli.php"] [unique_id "ac0zdjvP_a0662gDl6AHSQAAANQ"]
[Wed Apr 01 23:02:15.025528 2026] [:error] [pid 8995:tid 9002] [client 158.158.51.104:39902] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ynjli.php"] [unique_id "ac0zd-onaBjs3qxcRefsJQAAAAQ"]
[Wed Apr 01 23:02:15.550369 2026] [:error] [pid 8908:tid 8933] [client 158.158.51.104:24700] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a6.php"] [unique_id "ac0zd_kmxtJXGnLdvgDE8wAAAJQ"]
[Wed Apr 01 23:02:16.271939 2026] [:error] [pid 8995:tid 9017] [client 158.158.51.104:22030] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a6.php"] [unique_id "ac0zeOonaBjs3qxcRefsJwAAABM"]
[Wed Apr 01 23:02:16.962416 2026] [:error] [pid 8995:tid 9012] [client 158.158.51.104:37753] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a6.php"] [unique_id "ac0zeOonaBjs3qxcRefsKQAAAA4"]
[Wed Apr 01 23:02:17.507499 2026] [:error] [pid 62559:tid 62561] [client 158.158.51.104:39897] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a6.php"] [unique_id "ac0zeS7NKI8IaNKZFIfiOwAAAUA"]
[Wed Apr 01 23:02:18.046946 2026] [:error] [pid 17856:tid 17881] [client 158.158.51.104:45126] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0zej7Idlm5j9frhqR0fAAAAFc"]
[Wed Apr 01 23:02:18.569332 2026] [:error] [pid 17856:tid 17867] [client 158.158.51.104:24640] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0zej7Idlm5j9frhqR0gAAAAEk"]
[Wed Apr 01 23:02:19.254280 2026] [:error] [pid 62559:tid 62577] [client 158.158.51.104:63260] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0zey7NKI8IaNKZFIfiQAAAAVA"]
[Wed Apr 01 23:02:19.734671 2026] [:error] [pid 62559:tid 62566] [client 158.158.51.104:45189] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ac0zey7NKI8IaNKZFIfiQwAAAUU"]
[Wed Apr 01 23:02:20.263752 2026] [:error] [pid 8908:tid 8921] [client 158.158.51.104:40462] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sts.php"] [unique_id "ac0zfPkmxtJXGnLdvgDFAAAAAIg"]
[Wed Apr 01 23:02:20.769987 2026] [:error] [pid 8908:tid 8926] [client 158.158.51.104:3424] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sts.php"] [unique_id "ac0zfPkmxtJXGnLdvgDFAgAAAI0"]
[Wed Apr 01 23:02:21.250988 2026] [:error] [pid 8909:tid 8944] [client 158.158.51.104:45208] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sts.php"] [unique_id "ac0zfTvP_a0662gDl6AHXgAAAMM"]
[Wed Apr 01 23:02:21.759834 2026] [:error] [pid 62559:tid 62583] [client 158.158.51.104:45237] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sts.php"] [unique_id "ac0zfS7NKI8IaNKZFIfiTwAAAVY"]
[Wed Apr 01 23:02:22.263398 2026] [:error] [pid 62559:tid 62582] [client 158.158.51.104:34849] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0zfi7NKI8IaNKZFIfiWAAAAVU"]
[Wed Apr 01 23:02:22.767443 2026] [:error] [pid 62559:tid 62584] [client 158.158.51.104:3110] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0zfi7NKI8IaNKZFIfiXAAAAVc"]
[Wed Apr 01 23:02:23.283841 2026] [:error] [pid 62559:tid 62567] [client 158.158.51.104:63264] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0zfy7NKI8IaNKZFIfiYwAAAUY"]
[Wed Apr 01 23:02:23.912598 2026] [:error] [pid 62559:tid 62563] [client 158.158.51.104:3404] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hbvdoz7cy9k6xge9zhuvkvitCdefault.php"] [unique_id "ac0zfy7NKI8IaNKZFIfiawAAAUI"]
[Wed Apr 01 23:02:24.476061 2026] [:error] [pid 62559:tid 62567] [client 158.158.51.104:40466] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wziar1.php"] [unique_id "ac0zgC7NKI8IaNKZFIficQAAAUY"]
[Wed Apr 01 23:02:24.983552 2026] [:error] [pid 8909:tid 8960] [client 158.158.51.104:22029] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wziar1.php"] [unique_id "ac0zgDvP_a0662gDl6AHYgAAANM"]
[Wed Apr 01 23:02:25.498281 2026] [:error] [pid 17856:tid 17874] [client 158.158.51.104:22034] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wziar1.php"] [unique_id "ac0zgT7Idlm5j9frhqR0lAAAAFA"]
[Wed Apr 01 23:02:26.015452 2026] [:error] [pid 17856:tid 17869] [client 158.158.51.104:3392] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wziar1.php"] [unique_id "ac0zgj7Idlm5j9frhqR0lwAAAEs"]
[Wed Apr 01 23:02:26.598392 2026] [:error] [pid 8908:tid 8928] [client 158.158.51.104:45195] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fsgdjkl.php"] [unique_id "ac0zgvkmxtJXGnLdvgDFGwAAAI8"]
[Wed Apr 01 23:02:27.443418 2026] [:error] [pid 62559:tid 62574] [client 158.158.51.104:39883] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fsgdjkl.php"] [unique_id "ac0zgy7NKI8IaNKZFIfidgAAAU0"]
[Wed Apr 01 23:02:28.715560 2026] [:error] [pid 62559:tid 62565] [client 158.158.51.104:45167] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fsgdjkl.php"] [unique_id "ac0zhC7NKI8IaNKZFIfifwAAAUQ"]
[Wed Apr 01 23:02:29.422649 2026] [:error] [pid 62559:tid 62562] [client 158.158.51.104:39881] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fsgdjkl.php"] [unique_id "ac0zhS7NKI8IaNKZFIfihAAAAUE"]
[Wed Apr 01 23:02:31.475622 2026] [:error] [pid 8908:tid 8934] [client 158.158.51.104:34859] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0zh_kmxtJXGnLdvgDFIAAAAJU"]
[Wed Apr 01 23:02:32.363475 2026] [:error] [pid 8995:tid 9002] [client 158.158.51.104:3420] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0ziOonaBjs3qxcRefsTAAAAAQ"]
[Wed Apr 01 23:02:34.870272 2026] [:error] [pid 62559:tid 62562] [client 158.158.51.104:40497] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0zii7NKI8IaNKZFIfihgAAAUE"]
[Wed Apr 01 23:02:38.062978 2026] [:error] [pid 62559:tid 62583] [client 158.158.51.104:49512] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/exhds0ucw0ju9vjgasxqCdefault.php"] [unique_id "ac0zji7NKI8IaNKZFIfinwAAAVY"]
[Wed Apr 01 23:02:40.154795 2026] [:error] [pid 62559:tid 62573] [client 158.158.51.104:3084] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX2.php"] [unique_id "ac0zkC7NKI8IaNKZFIfiuAAAAUw"]
[Wed Apr 01 23:02:42.079226 2026] [:error] [pid 17856:tid 17880] [client 158.158.51.104:45246] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX2.php"] [unique_id "ac0zkj7Idlm5j9frhqR0vAAAAFY"]
[Wed Apr 01 23:02:43.269933 2026] [:error] [pid 8908:tid 8930] [client 158.158.51.104:32771] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX2.php"] [unique_id "ac0zk_kmxtJXGnLdvgDFUgAAAJE"]
[Wed Apr 01 23:02:43.867711 2026] [:error] [pid 8908:tid 8923] [client 158.158.51.104:32829] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX2.php"] [unique_id "ac0zk_kmxtJXGnLdvgDFVQAAAIo"]
[Wed Apr 01 23:02:44.363289 2026] [:error] [pid 17856:tid 17879] [client 158.158.51.104:23730] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a8.php"] [unique_id "ac0zlD7Idlm5j9frhqR0xAAAAFU"]
[Wed Apr 01 23:02:44.917819 2026] [:error] [pid 8910:tid 8975] [client 158.158.51.104:23698] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a8.php"] [unique_id "ac0zlKJZINUcF3tYgEx-xAAAAQc"]
[Wed Apr 01 23:02:45.436362 2026] [:error] [pid 8995:tid 8999] [client 158.158.51.104:20565] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a8.php"] [unique_id "ac0zleonaBjs3qxcRefsbQAAAAE"]
[Wed Apr 01 23:02:45.928478 2026] [:error] [pid 62559:tid 62571] [client 158.158.51.104:22068] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a8.php"] [unique_id "ac0zlS7NKI8IaNKZFIfi5QAAAUo"]
[Wed Apr 01 23:02:46.477485 2026] [:error] [pid 8995:tid 8998] [client 158.158.51.104:45229] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0zluonaBjs3qxcRefseAAAAAA"]
[Wed Apr 01 23:02:47.073495 2026] [:error] [pid 8908:tid 8936] [client 158.158.51.104:45221] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0zl_kmxtJXGnLdvgDFYAAAAJc"]
[Wed Apr 01 23:02:47.772935 2026] [:error] [pid 17856:tid 17882] [client 158.158.51.104:34825] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0zlz7Idlm5j9frhqR0zQAAAFg"]
[Wed Apr 01 23:02:48.474508 2026] [:error] [pid 62559:tid 62575] [client 158.158.51.104:34845] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lmutxdvyp7u5yksqke8ozbjgCdefault.php"] [unique_id "ac0zmC7NKI8IaNKZFIfi8gAAAU4"]
[Wed Apr 01 23:02:49.195989 2026] [:error] [pid 62559:tid 62570] [client 158.158.51.104:34877] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0zmS7NKI8IaNKZFIfi-gAAAUk"]
[Wed Apr 01 23:02:49.762178 2026] [:error] [pid 8910:tid 8985] [client 158.158.51.104:45169] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0zmaJZINUcF3tYgEx-yAAAARE"]
[Wed Apr 01 23:02:50.401589 2026] [:error] [pid 62559:tid 62563] [client 158.158.51.104:21343] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0zmi7NKI8IaNKZFIfjAgAAAUI"]
[Wed Apr 01 23:02:51.367885 2026] [:error] [pid 8995:tid 9006] [client 158.158.51.104:20601] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ortasekerli1.php"] [unique_id "ac0zm-onaBjs3qxcRefskQAAAAg"]
[Wed Apr 01 23:02:52.359960 2026] [:error] [pid 8909:tid 8959] [client 158.158.51.104:23735] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a7.php"] [unique_id "ac0znDvP_a0662gDl6AHugAAANI"]
[Wed Apr 01 23:02:53.261512 2026] [:error] [pid 8995:tid 9015] [client 158.158.51.104:32815] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a7.php"] [unique_id "ac0zneonaBjs3qxcRefslwAAABE"]
[Wed Apr 01 23:02:54.072517 2026] [:error] [pid 8910:tid 8988] [client 158.158.51.104:22031] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a7.php"] [unique_id "ac0znqJZINUcF3tYgEx-0AAAARQ"]
[Wed Apr 01 23:02:54.670904 2026] [:error] [pid 8908:tid 8924] [client 158.158.51.104:3397] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a7.php"] [unique_id "ac0znvkmxtJXGnLdvgDFeAAAAIs"]
[Wed Apr 01 23:02:56.086578 2026] [:error] [pid 17856:tid 17858] [client 158.158.51.104:21365] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/index-20260330022921.php"] [unique_id "ac0zoD7Idlm5j9frhqR08AAAAEA"]
[Wed Apr 01 23:02:56.891315 2026] [:error] [pid 62559:tid 62569] [client 158.158.51.104:32804] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/index-20260330022921.php"] [unique_id "ac0zoC7NKI8IaNKZFIfjFAAAAUg"]
[Wed Apr 01 23:02:57.654599 2026] [:error] [pid 62559:tid 62573] [client 158.158.51.104:22020] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/index-20260330022921.php"] [unique_id "ac0zoS7NKI8IaNKZFIfjGAAAAUw"]
[Wed Apr 01 23:02:59.793398 2026] [:error] [pid 8908:tid 8936] [client 158.158.51.104:20554] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/index-20260330022921.php"] [unique_id "ac0zo_kmxtJXGnLdvgDFmQAAAJc"]
[Wed Apr 01 23:03:01.969652 2026] [:error] [pid 8909:tid 8953] [client 158.158.51.104:22062] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Geforce.php"] [unique_id "ac0zpTvP_a0662gDl6AH3AAAAMw"]
[Wed Apr 01 23:03:03.337004 2026] [:error] [pid 62559:tid 62571] [client 158.158.51.104:34876] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Geforce.php"] [unique_id "ac0zpy7NKI8IaNKZFIfjNAAAAUo"]
[Wed Apr 01 23:03:04.066697 2026] [:error] [pid 62559:tid 62573] [client 158.158.51.104:40463] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Geforce.php"] [unique_id "ac0zqC7NKI8IaNKZFIfjNQAAAUw"]
[Wed Apr 01 23:03:04.612987 2026] [:error] [pid 8909:tid 8950] [client 158.158.51.104:45220] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Geforce.php"] [unique_id "ac0zqDvP_a0662gDl6AH6QAAAMk"]
[Wed Apr 01 23:03:05.378765 2026] [:error] [pid 62559:tid 62585] [client 158.158.51.104:21349] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/press.php"] [unique_id "ac0zqS7NKI8IaNKZFIfjPgAAAVg"]
[Wed Apr 01 23:03:13.093122 2026] [:error] [pid 62559:tid 62583] [client 158.158.51.104:3423] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/luyuc.php"] [unique_id "ac0zsS7NKI8IaNKZFIfjaAAAAVY"]
[Wed Apr 01 23:03:14.061868 2026] [:error] [pid 8910:tid 8987] [client 158.158.51.104:39917] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/luyuc.php"] [unique_id "ac0zsqJZINUcF3tYgEx-4wAAARM"]
[Wed Apr 01 23:03:15.171143 2026] [:error] [pid 8995:tid 9021] [client 158.158.51.104:37404] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/luyuc.php"] [unique_id "ac0zs-onaBjs3qxcRefsuQAAABc"]
[Wed Apr 01 23:03:16.032338 2026] [:error] [pid 8908:tid 8929] [client 158.158.51.104:40485] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/luyuc.php"] [unique_id "ac0ztPkmxtJXGnLdvgDFuQAAAJA"]
[Wed Apr 01 23:03:16.564271 2026] [:error] [pid 8908:tid 8918] [client 158.158.51.104:23688] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bless.php"] [unique_id "ac0ztPkmxtJXGnLdvgDFvgAAAIU"]
[Wed Apr 01 23:03:17.093396 2026] [:error] [pid 17856:tid 17860] [client 158.158.51.104:37405] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bless.php"] [unique_id "ac0ztT7Idlm5j9frhqR1LAAAAEI"]
[Wed Apr 01 23:03:17.604680 2026] [:error] [pid 8995:tid 9006] [client 158.158.51.104:45212] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bless.php"] [unique_id "ac0zteonaBjs3qxcRefsvQAAAAg"]
[Wed Apr 01 23:03:18.239791 2026] [:error] [pid 17856:tid 17863] [client 158.158.51.104:40449] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bless.php"] [unique_id "ac0ztj7Idlm5j9frhqR1LwAAAEU"]
[Wed Apr 01 23:03:18.717956 2026] [:error] [pid 17856:tid 17871] [client 158.158.51.104:3444] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/htto.php"] [unique_id "ac0ztj7Idlm5j9frhqR1NAAAAE0"]
[Wed Apr 01 23:03:19.297816 2026] [:error] [pid 17856:tid 17872] [client 158.158.51.104:49519] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/htto.php"] [unique_id "ac0ztz7Idlm5j9frhqR1NwAAAE4"]
[Wed Apr 01 23:03:19.911866 2026] [:error] [pid 8908:tid 8937] [client 158.158.51.104:24694] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/htto.php"] [unique_id "ac0zt_kmxtJXGnLdvgDFyQAAAJg"]
[Wed Apr 01 23:03:20.464684 2026] [:error] [pid 8908:tid 8914] [client 158.158.51.104:37420] [client 158.158.51.104] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/htto.php"] [unique_id "ac0zuPkmxtJXGnLdvgDFzgAAAIE"]
[Thu Apr 02 12:08:19.520988 2026] [:error] [pid 59305:tid 59328] [client 123.231.16.195:41837] [client 123.231.16.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.231.16.195, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ac3rs6r2tV4rDwKFxKeNdgAAANM"]
[Thu Apr 02 20:30:37.111596 2026] [:error] [pid 23927:tid 23941] [client 20.107.223.239:25286] [client 20.107.223.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/app.php"] [unique_id "ac5hbUsZwqCndhl9uKC-FgAAAYw"]
[Thu Apr 02 20:31:07.215550 2026] [:error] [pid 29467:tid 29477] [client 20.107.223.239:17506] [client 20.107.223.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ac5hi74VUBFCJAq-WOmT-QAAAQc"]
[Thu Apr 02 20:31:09.030451 2026] [:error] [pid 37543:tid 37567] [client 20.107.223.239:17990] [client 20.107.223.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ac5hjXhdk2bEYJCvILbl1gAAAVY"]
[Fri Apr 03 04:00:04.295378 2026] [:error] [pid 22778:tid 22807] [client 4.232.184.177:37235] [client 4.232.184.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ac7KxPS-q9hkdFqUjq87YgAAANY"]
[Fri Apr 03 15:54:33.187624 2026] [:error] [pid 33446:tid 33485] [client 98.159.37.81:37623] [client 98.159.37.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ac9yOdg3dCqFYIIdw0q-sAAAAEg"]
[Fri Apr 03 20:28:28.932972 2026] [:error] [pid 33446:tid 33492] [client 182.10.129.249:20964] [client 182.10.129.249] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.10.129.249, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ac-ybNg3dCqFYIIdw0pKUwAAAE8"]
[Sat Apr 04 03:01:11.814404 2026] [:error] [pid 12233:tid 12258] [client 172.71.172.91:13107] [client 172.71.172.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adAOdxQDAzkmdfiSgI31WQAAARc"]
[Sat Apr 04 03:01:11.818687 2026] [:error] [pid 12089:tid 12140] [client 172.71.172.91:13100] [client 172.71.172.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/refs/heads/main"] [unique_id "adAOd0SCG1Z_hi7I_jKNKgAAAI0"]
[Sat Apr 04 03:01:11.887587 2026] [:error] [pid 12233:tid 12241] [client 172.71.172.104:9731] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/refs/heads/master"] [unique_id "adAOdxQDAzkmdfiSgI31WgAAAQY"]
[Sat Apr 04 03:01:11.913212 2026] [:error] [pid 44382:tid 44399] [client 172.71.172.105:10747] [client 172.71.172.105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "adAOd5pzSLFOX5FpZ8rdDgAAAA8"]
[Sat Apr 04 03:01:11.913275 2026] [:error] [pid 44382:tid 44407] [client 172.71.172.104:9739] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/logs/HEAD"] [unique_id "adAOd5pzSLFOX5FpZ8rdDwAAABc"]
[Sat Apr 04 03:01:12.838314 2026] [:error] [pid 44382:tid 44388] [client 172.71.172.90:12258] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.local"] [unique_id "adAOeJpzSLFOX5FpZ8rdEAAAAAQ"]
[Sat Apr 04 03:01:12.917250 2026] [:error] [pid 44382:tid 44397] [client 172.71.172.90:12266] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.dev"] [unique_id "adAOeJpzSLFOX5FpZ8rdEQAAAA0"]
[Sat Apr 04 03:01:12.929178 2026] [:error] [pid 12233:tid 12242] [client 172.71.172.105:10750] [client 172.71.172.105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production"] [unique_id "adAOeBQDAzkmdfiSgI31WwAAAQc"]
[Sat Apr 04 03:01:13.861179 2026] [:error] [pid 12089:tid 12133] [client 172.71.172.90:12269] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.test"] [unique_id "adAOeUSCG1Z_hi7I_jKNMQAAAIY"]
[Sat Apr 04 03:01:31.155813 2026] [:error] [pid 12233:tid 12241] [client 172.71.172.104:10437] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.old"] [unique_id "adAOixQDAzkmdfiSgI31rQAAAQY"]
[Sat Apr 04 03:01:31.454195 2026] [:error] [pid 12233:tid 12253] [client 162.158.3.84:9644] [client 162.158.3.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.save"] [unique_id "adAOixQDAzkmdfiSgI31sAAAARI"]
[Sat Apr 04 03:01:31.456910 2026] [:error] [pid 12233:tid 12248] [client 162.158.3.84:9649] [client 162.158.3.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.tmp"] [unique_id "adAOixQDAzkmdfiSgI31sQAAAQ0"]
[Sat Apr 04 03:01:31.740447 2026] [:error] [pid 12081:tid 12117] [client 162.158.3.79:10370] [client 162.158.3.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.example"] [unique_id "adAOi6MJBCYerZTQdmI1rgAAAFE"]
[Sat Apr 04 03:01:32.447501 2026] [:error] [pid 12081:tid 12124] [client 172.71.172.104:10439] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production.local"] [unique_id "adAOjKMJBCYerZTQdmI1sQAAAFg"]
[Sat Apr 04 03:01:32.704396 2026] [:error] [pid 12233:tid 12243] [client 172.71.172.91:10850] [client 172.71.172.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.development.local"] [unique_id "adAOjBQDAzkmdfiSgI31twAAAQg"]
[Sat Apr 04 03:01:32.742930 2026] [:error] [pid 44382:tid 44390] [client 162.158.3.83:14115] [client 162.158.3.83] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/backend/.env"] [unique_id "adAOjJpzSLFOX5FpZ8rdVQAAAAY"]
[Sat Apr 04 03:01:32.746989 2026] [:error] [pid 44382:tid 44386] [client 172.71.172.91:10855] [client 172.71.172.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/config/.env"] [unique_id "adAOjJpzSLFOX5FpZ8rdVgAAAAI"]
[Sat Apr 04 03:01:33.199561 2026] [:error] [pid 12233:tid 12251] [client 172.71.172.104:10442] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/app/.env"] [unique_id "adAOjRQDAzkmdfiSgI31ugAAARA"]
[Sat Apr 04 03:01:33.712759 2026] [:error] [pid 44382:tid 44406] [client 172.71.172.90:10124] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/api/.env"] [unique_id "adAOjZpzSLFOX5FpZ8rdWwAAABY"]
[Sat Apr 04 03:01:33.729923 2026] [:error] [pid 12233:tid 12236] [client 172.71.172.90:10125] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/admin/.env"] [unique_id "adAOjRQDAzkmdfiSgI31vAAAAQE"]
[Sat Apr 04 03:01:33.748947 2026] [:error] [pid 12233:tid 12257] [client 172.71.172.105:12751] [client 172.71.172.105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/public/.env"] [unique_id "adAOjRQDAzkmdfiSgI31vQAAARY"]
[Sat Apr 04 03:01:33.753468 2026] [:error] [pid 12081:tid 12122] [client 172.71.172.105:12747] [client 172.71.172.105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/core/.env"] [unique_id "adAOjaMJBCYerZTQdmI1swAAAFY"]
[Sat Apr 04 03:01:34.046070 2026] [:error] [pid 44382:tid 44391] [client 162.158.3.128:11096] [client 162.158.3.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.json"] [unique_id "adAOjppzSLFOX5FpZ8rdXgAAAAc"]
[Sat Apr 04 03:01:34.231391 2026] [:error] [pid 12233:tid 12255] [client 172.71.172.90:10131] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/private/.env"] [unique_id "adAOjhQDAzkmdfiSgI31wQAAARQ"]
[Sat Apr 04 03:01:34.535552 2026] [:error] [pid 12097:tid 12176] [client 162.158.3.107:13970] [client 162.158.3.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env1"] [unique_id "adAOjhnkcvJ01y2CY3ncVQAAANU"]
[Sat Apr 04 03:01:34.733661 2026] [:error] [pid 44382:tid 44397] [client 172.71.172.104:11179] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.php"] [unique_id "adAOjppzSLFOX5FpZ8rdYAAAAA0"]
[Sat Apr 04 03:01:34.791213 2026] [:error] [pid 44382:tid 44392] [client 172.71.172.90:10133] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env_backup"] [unique_id "adAOjppzSLFOX5FpZ8rdYQAAAAg"]
[Sat Apr 04 03:01:34.822932 2026] [:error] [pid 44382:tid 44390] [client 162.158.3.107:13974] [client 162.158.3.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.dist"] [unique_id "adAOjppzSLFOX5FpZ8rdYgAAAAY"]
[Sat Apr 04 03:01:35.048999 2026] [:error] [pid 12233:tid 12245] [client 172.71.172.91:10859] [client 172.71.172.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env~"] [unique_id "adAOjxQDAzkmdfiSgI31xgAAAQo"]
[Sat Apr 04 03:01:35.096605 2026] [:error] [pid 12233:tid 12254] [client 162.158.3.79:10372] [client 162.158.3.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.orig"] [unique_id "adAOjxQDAzkmdfiSgI31xwAAARM"]
[Sat Apr 04 03:01:35.240828 2026] [:error] [pid 12233:tid 12241] [client 172.71.172.91:10862] [client 172.71.172.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env2"] [unique_id "adAOjxQDAzkmdfiSgI31yAAAAQY"]
[Sat Apr 04 03:01:35.336988 2026] [:error] [pid 12233:tid 12250] [client 172.71.172.104:11176] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.dev.local"] [unique_id "adAOjxQDAzkmdfiSgI31yQAAAQ8"]
[Sat Apr 04 03:01:35.725897 2026] [:error] [pid 44382:tid 44389] [client 172.71.172.90:10138] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.envrc"] [unique_id "adAOj5pzSLFOX5FpZ8rdaQAAAAU"]
[Sat Apr 04 03:01:35.805998 2026] [:error] [pid 44382:tid 44399] [client 172.71.172.91:10870] [client 172.71.172.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production.bak"] [unique_id "adAOj5pzSLFOX5FpZ8rdagAAAA8"]
[Sat Apr 04 03:01:36.021579 2026] [:error] [pid 44382:tid 44404] [client 162.158.3.99:13830] [client 162.158.3.99] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/docker/.env"] [unique_id "adAOkJpzSLFOX5FpZ8rdbQAAABQ"]
[Sat Apr 04 03:01:36.060019 2026] [:error] [pid 44382:tid 44385] [client 172.71.172.90:10146] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.prod"] [unique_id "adAOkJpzSLFOX5FpZ8rdbgAAAAE"]
[Sat Apr 04 03:01:36.265974 2026] [:error] [pid 44382:tid 44398] [client 172.71.172.91:10874] [client 172.71.172.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.docker"] [unique_id "adAOkJpzSLFOX5FpZ8rdcQAAAA4"]
[Sat Apr 04 03:01:36.368583 2026] [:error] [pid 44382:tid 44397] [client 172.71.172.105:12755] [client 172.71.172.105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.container"] [unique_id "adAOkJpzSLFOX5FpZ8rdcwAAAA0"]
[Sat Apr 04 03:01:36.670655 2026] [:error] [pid 44382:tid 44387] [client 162.158.3.84:9652] [client 162.158.3.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/srv/.env"] [unique_id "adAOkJpzSLFOX5FpZ8rddAAAAAM"]
[Sat Apr 04 03:01:37.040897 2026] [:error] [pid 12097:tid 12174] [client 172.71.172.91:10879] [client 172.71.172.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/docker/.env.local"] [unique_id "adAOkRnkcvJ01y2CY3ncWAAAANM"]
[Sat Apr 04 03:01:37.093585 2026] [:error] [pid 12089:tid 12148] [client 172.71.172.105:12762] [client 172.71.172.105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/server/.env"] [unique_id "adAOkUSCG1Z_hi7I_jKNSgAAAJU"]
[Sat Apr 04 03:01:37.133177 2026] [:error] [pid 12089:tid 12139] [client 162.158.3.84:9657] [client 162.158.3.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/site/.env"] [unique_id "adAOkUSCG1Z_hi7I_jKNSwAAAIw"]
[Sat Apr 04 03:01:37.300281 2026] [:error] [pid 12081:tid 12107] [client 172.71.172.90:10150] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/www/.env"] [unique_id "adAOkaMJBCYerZTQdmI1wwAAAEc"]
[Sat Apr 04 03:01:37.417014 2026] [:error] [pid 12089:tid 12128] [client 162.158.3.100:11059] [client 162.158.3.100] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/var/www/html/.env"] [unique_id "adAOkUSCG1Z_hi7I_jKNTAAAAIE"]
[Sat Apr 04 03:01:37.683193 2026] [:error] [pid 12081:tid 12124] [client 172.71.172.104:11186] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/web/.env"] [unique_id "adAOkaMJBCYerZTQdmI1xgAAAFg"]
[Sat Apr 04 03:01:38.094876 2026] [:error] [pid 12089:tid 12132] [client 172.71.172.105:12766] [client 172.71.172.105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/var/www/.env"] [unique_id "adAOkkSCG1Z_hi7I_jKNTwAAAIU"]
[Sat Apr 04 03:01:38.311264 2026] [:error] [pid 12089:tid 12131] [client 172.71.172.104:11194] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/home/.env"] [unique_id "adAOkkSCG1Z_hi7I_jKNUQAAAIQ"]
[Sat Apr 04 03:01:38.435692 2026] [:error] [pid 12089:tid 12127] [client 172.71.172.90:10158] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/root/.env"] [unique_id "adAOkkSCG1Z_hi7I_jKNUgAAAIA"]
[Sat Apr 04 03:01:38.680788 2026] [:error] [pid 12097:tid 12172] [client 172.71.172.90:10159] [client 172.71.172.90] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env_secret"] [unique_id "adAOkhnkcvJ01y2CY3ncXgAAANE"]
[Sat Apr 04 03:01:38.726879 2026] [:error] [pid 12233:tid 12239] [client 172.71.172.104:11195] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env_config"] [unique_id "adAOkhQDAzkmdfiSgI314gAAAQQ"]
[Sat Apr 04 03:01:38.949890 2026] [:error] [pid 12081:tid 12123] [client 172.71.172.104:13676] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "adAOkqMJBCYerZTQdmI1zAAAAFc"]
[Sat Apr 04 03:01:39.110928 2026] [:error] [pid 12081:tid 12116] [client 172.71.172.104:11200] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env_settings"] [unique_id "adAOk6MJBCYerZTQdmI1zQAAAFA"]
[Sat Apr 04 03:01:39.242392 2026] [:error] [pid 12081:tid 12100] [client 172.71.172.104:13682] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/index"] [unique_id "adAOk6MJBCYerZTQdmI10AAAAEA"]
[Sat Apr 04 03:01:39.321158 2026] [:error] [pid 12081:tid 12117] [client 172.71.172.104:11205] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.local.backup"] [unique_id "adAOk6MJBCYerZTQdmI10gAAAFE"]
[Sat Apr 04 03:01:39.455946 2026] [:error] [pid 12081:tid 12120] [client 172.71.172.104:13687] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/logs/HEAD"] [unique_id "adAOk6MJBCYerZTQdmI10wAAAFQ"]
[Sat Apr 04 03:01:39.742879 2026] [:error] [pid 12233:tid 12236] [client 172.71.172.105:10008] [client 172.71.172.105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/refs/heads/master"] [unique_id "adAOkxQDAzkmdfiSgI315wAAAQE"]
[Sat Apr 04 03:01:39.868824 2026] [:error] [pid 44382:tid 44405] [client 172.71.172.91:11936] [client 172.71.172.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "adAOk5pzSLFOX5FpZ8rdeQAAABU"]
[Sat Apr 04 03:01:40.240624 2026] [:error] [pid 12081:tid 12104] [client 172.71.172.105:10015] [client 172.71.172.105] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production"] [unique_id "adAOlKMJBCYerZTQdmI11QAAAEQ"]
[Sat Apr 04 03:01:53.468160 2026] [:error] [pid 12097:tid 12158] [client 162.158.3.84:10938] [client 162.158.3.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/config/.env.local"] [unique_id "adAOoRnkcvJ01y2CY3nccQAAAMM"]
[Sat Apr 04 03:01:58.803615 2026] [:error] [pid 12089:tid 12128] [client 172.71.172.91:10223] [client 172.71.172.91] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.staging"] [unique_id "adAOpkSCG1Z_hi7I_jKNXQAAAIE"]
[Sat Apr 04 03:01:58.894866 2026] [:error] [pid 44382:tid 44397] [client 162.158.3.145:10423] [client 162.158.3.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.backup"] [unique_id "adAOpppzSLFOX5FpZ8rdvgAAAA0"]
[Sat Apr 04 03:01:59.396928 2026] [:error] [pid 44382:tid 44407] [client 172.71.172.104:13549] [client 172.71.172.104] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.old"] [unique_id "adAOp5pzSLFOX5FpZ8rdwQAAABc"]
[Sat Apr 04 03:01:59.410824 2026] [:error] [pid 44382:tid 44385] [client 162.158.3.108:12697] [client 162.158.3.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.save"] [unique_id "adAOp5pzSLFOX5FpZ8rdwgAAAAE"]
[Sat Apr 04 03:01:59.693294 2026] [:error] [pid 12089:tid 12137] [client 162.158.2.140:11781] [client 162.158.2.140] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production.local"] [unique_id "adAOp0SCG1Z_hi7I_jKNYQAAAIo"]
[Sat Apr 04 03:01:59.920525 2026] [:error] [pid 44382:tid 44402] [client 162.158.3.102:12094] [client 162.158.3.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.development.local"] [unique_id "adAOp5pzSLFOX5FpZ8rdxgAAABI"]
[Sat Apr 04 03:02:00.196048 2026] [:error] [pid 12233:tid 12253] [client 162.158.3.102:12101] [client 162.158.3.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/app/.env"] [unique_id "adAOqBQDAzkmdfiSgI32HQAAARI"]
[Sat Apr 04 03:02:00.468906 2026] [:error] [pid 12081:tid 12113] [client 162.158.3.108:12700] [client 162.158.3.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/backend/.env"] [unique_id "adAOqKMJBCYerZTQdmI2AQAAAE0"]
[Sat Apr 04 03:02:00.742786 2026] [:error] [pid 44382:tid 44384] [client 162.158.3.127:11784] [client 162.158.3.127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/api/.env"] [unique_id "adAOqJpzSLFOX5FpZ8rdyQAAAAA"]
[Sat Apr 04 03:02:13.154459 2026] [:error] [pid 12081:tid 12109] [client 162.158.2.97:14178] [client 162.158.2.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/core/.env"] [unique_id "adAOtaMJBCYerZTQdmI2CAAAAEk"]
[Sat Apr 04 03:02:13.432296 2026] [:error] [pid 12081:tid 12121] [client 162.158.2.137:13535] [client 162.158.2.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/public/.env"] [unique_id "adAOtaMJBCYerZTQdmI2CwAAAFU"]
[Sat Apr 04 03:02:13.713891 2026] [:error] [pid 12081:tid 12107] [client 162.158.3.95:11191] [client 162.158.3.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/private/.env"] [unique_id "adAOtaMJBCYerZTQdmI2DAAAAEc"]
[Sat Apr 04 03:02:14.276918 2026] [:error] [pid 12081:tid 12101] [client 162.158.3.84:11707] [client 162.158.3.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/config/.env.local"] [unique_id "adAOtqMJBCYerZTQdmI2EgAAAEE"]
[Sat Apr 04 03:02:14.557108 2026] [:error] [pid 12081:tid 12122] [client 162.158.3.84:11711] [client 162.158.3.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.php"] [unique_id "adAOtqMJBCYerZTQdmI2EwAAAFY"]
[Sat Apr 04 03:02:14.834252 2026] [:error] [pid 12089:tid 12150] [client 162.158.3.128:12827] [client 162.158.3.128] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.json"] [unique_id "adAOtkSCG1Z_hi7I_jKNcQAAAJc"]
[Sat Apr 04 03:02:18.777831 2026] [:error] [pid 12081:tid 12115] [client 162.158.3.127:13379] [client 162.158.3.127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env~"] [unique_id "adAOuqMJBCYerZTQdmI2IgAAAE8"]
[Sat Apr 04 03:02:19.055804 2026] [:error] [pid 12081:tid 12107] [client 162.158.2.93:10318] [client 162.158.2.93] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env1"] [unique_id "adAOu6MJBCYerZTQdmI2IwAAAEc"]
[Sat Apr 04 03:02:19.289487 2026] [:error] [pid 12081:tid 12120] [client 162.158.3.107:10912] [client 162.158.3.107] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env2"] [unique_id "adAOu6MJBCYerZTQdmI2JAAAAFQ"]
[Sat Apr 04 03:02:19.290108 2026] [:error] [pid 12233:tid 12245] [client 162.158.2.97:14184] [client 162.158.2.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.envrc"] [unique_id "adAOuxQDAzkmdfiSgI32QQAAAQo"]
[Sat Apr 04 03:02:19.290332 2026] [:error] [pid 12233:tid 12259] [client 162.158.2.139:9828] [client 162.158.2.139] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.dist"] [unique_id "adAOuxQDAzkmdfiSgI32QgAAARg"]
[Sat Apr 04 03:02:19.335943 2026] [:error] [pid 12089:tid 12137] [client 162.158.2.141:11929] [client 162.158.2.141] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.orig"] [unique_id "adAOu0SCG1Z_hi7I_jKNegAAAIo"]
[Sat Apr 04 03:02:19.564609 2026] [:error] [pid 12233:tid 12238] [client 162.158.3.79:13533] [client 162.158.3.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production.bak"] [unique_id "adAOuxQDAzkmdfiSgI32QwAAAQM"]
[Sat Apr 04 03:02:19.572404 2026] [:error] [pid 12081:tid 12111] [client 162.158.2.96:11948] [client 162.158.2.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.dev.local"] [unique_id "adAOu6MJBCYerZTQdmI2JgAAAEs"]
[Sat Apr 04 03:02:19.613346 2026] [:error] [pid 12097:tid 12163] [client 162.158.3.95:11197] [client 162.158.3.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.docker"] [unique_id "adAOuxnkcvJ01y2CY3ncjQAAAMg"]
[Sat Apr 04 03:02:19.847334 2026] [:error] [pid 44382:tid 44392] [client 162.158.3.108:12852] [client 162.158.3.108] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.container"] [unique_id "adAOu5pzSLFOX5FpZ8reEgAAAAg"]
[Sat Apr 04 03:02:19.890976 2026] [:error] [pid 44382:tid 44394] [client 162.158.3.84:11715] [client 162.158.3.84] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/docker/.env"] [unique_id "adAOu5pzSLFOX5FpZ8reEwAAAAo"]
[Sat Apr 04 03:02:20.168099 2026] [:error] [pid 12233:tid 12253] [client 162.158.3.145:10837] [client 162.158.3.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/docker/.env.local"] [unique_id "adAOvBQDAzkmdfiSgI32RQAAARI"]
[Sat Apr 04 03:02:20.399874 2026] [:error] [pid 12081:tid 12122] [client 162.158.3.146:11789] [client 162.158.3.146] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/admin/.env"] [unique_id "adAOvKMJBCYerZTQdmI2JwAAAFY"]
[Sat Apr 04 03:02:20.447297 2026] [:error] [pid 12089:tid 12134] [client 162.158.3.102:9891] [client 162.158.3.102] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/server/.env"] [unique_id "adAOvESCG1Z_hi7I_jKNfAAAAIc"]
[Sat Apr 04 03:02:20.682958 2026] [:error] [pid 12097:tid 12179] [client 162.158.2.137:12491] [client 162.158.2.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/srv/.env"] [unique_id "adAOvBnkcvJ01y2CY3nckQAAANg"]
[Sat Apr 04 03:02:20.723322 2026] [:error] [pid 12097:tid 12157] [client 162.158.3.145:10839] [client 162.158.3.145] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/web/.env"] [unique_id "adAOvBnkcvJ01y2CY3nckgAAAMI"]
[Sat Apr 04 03:02:20.965969 2026] [:error] [pid 12081:tid 12105] [client 162.158.2.97:14186] [client 162.158.2.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/site/.env"] [unique_id "adAOvKMJBCYerZTQdmI2KAAAAEU"]
[Sat Apr 04 03:02:21.001315 2026] [:error] [pid 44382:tid 44406] [client 162.158.3.79:13534] [client 162.158.3.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/www/.env"] [unique_id "adAOvZpzSLFOX5FpZ8reGwAAABY"]
[Sat Apr 04 03:02:21.138612 2026] [:error] [pid 12233:tid 12240] [client 162.158.3.96:11948] [client 162.158.3.96] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/var/www/.env"] [unique_id "adAOvRQDAzkmdfiSgI32SAAAAQU"]
[Sat Apr 04 03:02:21.213538 2026] [:error] [pid 12233:tid 12251] [client 162.158.2.158:13730] [client 162.158.2.158] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/var/www/html/.env"] [unique_id "adAOvRQDAzkmdfiSgI32SQAAARA"]
[Sat Apr 04 03:02:21.239983 2026] [:error] [pid 44382:tid 44402] [client 162.158.2.97:14189] [client 162.158.2.97] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/home/.env"] [unique_id "adAOvZpzSLFOX5FpZ8reHgAAABI"]
[Sat Apr 04 03:02:21.280757 2026] [:error] [pid 12081:tid 12118] [client 162.158.2.204:10753] [client 162.158.2.204] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/root/.env"] [unique_id "adAOvaMJBCYerZTQdmI2KQAAAFI"]
[Sat Apr 04 03:02:21.414937 2026] [:error] [pid 44382:tid 44388] [client 162.158.3.138:12582] [client 162.158.3.138] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env_config"] [unique_id "adAOvZpzSLFOX5FpZ8reIAAAAAQ"]
[Sat Apr 04 03:02:21.494283 2026] [:error] [pid 44382:tid 44390] [client 162.158.3.127:13381] [client 162.158.3.127] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env_secret"] [unique_id "adAOvZpzSLFOX5FpZ8reIQAAAAY"]
[Sat Apr 04 03:02:21.515013 2026] [:error] [pid 44382:tid 44396] [client 162.158.2.159:13502] [client 162.158.2.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env_settings"] [unique_id "adAOvZpzSLFOX5FpZ8reIgAAAAw"]
[Sat Apr 04 03:02:21.561052 2026] [:error] [pid 44382:tid 44408] [client 162.158.3.79:13536] [client 162.158.3.79] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.local.backup"] [unique_id "adAOvZpzSLFOX5FpZ8reIwAAABg"]
[Sat Apr 04 03:02:34.421076 2026] [:error] [pid 12097:tid 12165] [client 162.158.3.83:14284] [client 162.158.3.83] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env_backup"] [unique_id "adAOyhnkcvJ01y2CY3ncpwAAAMo"]
[Sat Apr 04 03:02:39.256091 2026] [:error] [pid 12089:tid 12134] [client 162.158.3.81:14331] [client 162.158.3.81] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.prod"] [unique_id "adAOz0SCG1Z_hi7I_jKNjQAAAIc"]
[Sat Apr 04 13:21:16.675957 2026] [:error] [pid 37114:tid 37131] [client 185.198.240.89:62391] [client 185.198.240.89] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "adCfzM-DnSj3fGMexeJpLwAAAQ8"]
[Sat Apr 04 14:21:06.702089 2026] [:error] [pid 37114:tid 37128] [client 129.222.1.107:24380] [client 129.222.1.107] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 129.222.1.107, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "adCt0s-DnSj3fGMexeKTRgAAAQw"]
[Sun Apr 05 09:20:53.880533 2026] [:error] [pid 45409:tid 45423] [client 217.216.37.55:62079] [client 217.216.37.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "adG49dHt_Oyw03gjCNg_5wAAAMw"]
[Sun Apr 05 09:20:54.091862 2026] [:error] [pid 45409:tid 45429] [client 217.216.37.55:55104] [client 217.216.37.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "adG49tHt_Oyw03gjCNg_6gAAANI"]
[Sun Apr 05 09:20:54.305765 2026] [:error] [pid 30921:tid 30935] [client 217.216.37.55:57579] [client 217.216.37.55] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/media/system/js/core.js"] [unique_id "adG49mFGQVn8Q0ueB27BFgAAAQw"]
[Sun Apr 05 11:21:30.285196 2026] [:error] [pid 30921:tid 30923] [client 20.151.201.236:22246] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "adHVOmFGQVn8Q0ueB275iwAAAQA"]
[Sun Apr 05 11:21:37.472200 2026] [:error] [pid 45304:tid 45347] [client 20.151.201.236:36124] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adHVQQ5jnqDKKovdRkllcQAAAEM"]
[Sun Apr 05 11:21:40.122455 2026] [:error] [pid 45304:tid 45366] [client 20.151.201.236:9088] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.paramountestate.com.au"] [uri "/fm.php"] [unique_id "adHVRA5jnqDKKovdRkllfAAAAFY"]
[Sun Apr 05 11:21:48.548021 2026] [:error] [pid 45305:tid 45379] [client 20.151.201.236:43776] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adHVTOjDQjr7aWhjflAgxAAAAIg"]
[Sun Apr 05 11:21:50.490647 2026] [:error] [pid 45304:tid 45356] [client 20.151.201.236:36114] [client 20.151.201.236] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/images/chosen.php"] [unique_id "adHVTg5jnqDKKovdRkllwAAAAEw"]
[Sun Apr 05 22:12:16.844150 2026] [:error] [pid 45303:tid 45322] [client 51.103.148.24:1934] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/wp-login.php"] [unique_id "adJtwLboQ9eViZ4hdnlcXgAAAAU"]
[Sun Apr 05 22:12:18.676330 2026] [:error] [pid 30921:tid 30939] [client 51.103.148.24:2007] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adJtwmFGQVn8Q0ueB24ziQAAARA"]
[Sun Apr 05 22:12:19.519833 2026] [:error] [pid 45303:tid 45337] [client 51.103.148.24:2018] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adJtw7boQ9eViZ4hdnlcZAAAABQ"]
[Sun Apr 05 22:12:20.696607 2026] [:error] [pid 45409:tid 45416] [client 51.103.148.24:2009] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/about.php"] [unique_id "adJtxNHt_Oyw03gjCNgssgAAAMU"]
[Sun Apr 05 22:12:23.581934 2026] [:error] [pid 30921:tid 30947] [client 51.103.148.24:1928] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adJtx2FGQVn8Q0ueB24zmQAAARg"]
[Sun Apr 05 22:12:24.254770 2026] [:error] [pid 45409:tid 45426] [client 51.103.148.24:1923] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adJtyNHt_Oyw03gjCNgsvwAAAM8"]
[Sun Apr 05 22:12:28.391876 2026] [:error] [pid 30921:tid 30939] [client 51.103.148.24:1937] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adJtzGFGQVn8Q0ueB24zrgAAARA"]
[Sun Apr 05 22:12:32.976939 2026] [:error] [pid 45303:tid 45337] [client 51.103.148.24:2002] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "adJt0LboQ9eViZ4hdnlciQAAABQ"]
[Sun Apr 05 22:12:33.509209 2026] [:error] [pid 45409:tid 45425] [client 51.103.148.24:2030] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "adJt0dHt_Oyw03gjCNgtBwAAAM4"]
[Sun Apr 05 22:12:34.164635 2026] [:error] [pid 45409:tid 45433] [client 51.103.148.24:1931] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/wp-login.php"] [unique_id "adJt0tHt_Oyw03gjCNgtDgAAANY"]
[Sun Apr 05 22:12:36.282875 2026] [:error] [pid 45305:tid 45387] [client 51.103.148.24:2031] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adJt1OjDQjr7aWhjflBuigAAAJA"]
[Sun Apr 05 22:12:39.164721 2026] [:error] [pid 30921:tid 30944] [client 51.103.148.24:1984] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/about.php"] [unique_id "adJt12FGQVn8Q0ueB24z9AAAARU"]
[Sun Apr 05 22:12:39.869727 2026] [:error] [pid 45409:tid 45424] [client 51.103.148.24:2038] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/alfa-rex.php"] [unique_id "adJt19Ht_Oyw03gjCNgtOQAAAM0"]
[Sun Apr 05 22:12:40.710122 2026] [:error] [pid 45409:tid 45413] [client 51.103.148.24:1935] [client 51.103.148.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adJt2NHt_Oyw03gjCNgtPgAAAMI"]
[Mon Apr 06 01:51:05.573755 2026] [:error] [pid 51753:tid 51828] [client 51.12.90.153:41448] [client 51.12.90.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adKhCa3pmp1JkaicYbuWywAAARE"]
[Mon Apr 06 01:51:11.858662 2026] [:error] [pid 51580:tid 51663] [client 51.12.90.153:9653] [client 51.12.90.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "adKhD1NFl1NiyNgNZAlBzwAAAFg"]
[Mon Apr 06 01:51:23.134392 2026] [:error] [pid 51580:tid 51650] [client 51.12.90.153:55367] [client 51.12.90.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adKhG1NFl1NiyNgNZAlB-QAAAEs"]
[Mon Apr 06 01:51:27.145933 2026] [:error] [pid 51584:tid 51715] [client 51.12.90.153:48737] [client 51.12.90.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.paramountestate.com.au"] [uri "/fm.php"] [unique_id "adKhH8Z4qY_GoNCPARAy7wAAANI"]
[Mon Apr 06 01:51:30.142748 2026] [:error] [pid 51581:tid 51682] [client 51.12.90.153:62053] [client 51.12.90.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "adKhIt4k74fhQLPUy7FN5wAAAI0"]
[Mon Apr 06 19:24:12.288842 2026] [:error] [pid 35688:tid 35772] [client 62.197.144.85:48930] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adOX3OZ85qg4jLsRpQyH-QAAAJY"]
[Mon Apr 06 19:24:14.336826 2026] [:error] [pid 9442:tid 9445] [client 62.197.144.85:36528] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adOX3kPsNnAJTnmz6saemQAAAQE"]
[Mon Apr 06 19:24:17.673456 2026] [:error] [pid 38562:tid 38582] [client 62.197.144.85:36550] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adOX4aeD6Ohe6wzRuy5xjAAAAVE"]
[Mon Apr 06 19:24:23.627809 2026] [:error] [pid 9442:tid 9457] [client 62.197.144.85:48606] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "adOX50PsNnAJTnmz6sae3QAAAQ0"]
[Mon Apr 06 19:24:27.007825 2026] [:error] [pid 1827:tid 1850] [client 62.197.144.85:48662] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adOX6-Veb6S_DnjZ2xEAsgAAAhU"]
[Mon Apr 06 19:24:28.242948 2026] [:error] [pid 9442:tid 9450] [client 62.197.144.85:36820] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adOX7EPsNnAJTnmz6sae-QAAAQY"]
[Mon Apr 06 19:24:29.081866 2026] [:error] [pid 38562:tid 38570] [client 62.197.144.85:36830] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adOX7aeD6Ohe6wzRuy5xngAAAUU"]
[Mon Apr 06 19:24:29.919780 2026] [:error] [pid 38562:tid 38588] [client 62.197.144.85:36842] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adOX7aeD6Ohe6wzRuy5xnwAAAVc"]
[Mon Apr 06 19:24:30.834286 2026] [:error] [pid 1827:tid 1851] [client 62.197.144.85:36858] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adOX7uVeb6S_DnjZ2xEAyAAAAhY"]
[Mon Apr 06 19:24:31.701443 2026] [:error] [pid 35687:tid 35745] [client 62.197.144.85:36870] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adOX753LtDozV0i8BitgMQAAAFY"]
[Mon Apr 06 19:24:32.953518 2026] [:error] [pid 38562:tid 38574] [client 62.197.144.85:36888] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adOX8KeD6Ohe6wzRuy5xpQAAAUk"]
[Mon Apr 06 19:24:34.592773 2026] [:error] [pid 38562:tid 38573] [client 62.197.144.85:36906] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "adOX8qeD6Ohe6wzRuy5xrgAAAUg"]
[Mon Apr 06 19:24:36.277447 2026] [:error] [pid 35688:tid 35760] [client 62.197.144.85:39692] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adOX9OZ85qg4jLsRpQyITwAAAIo"]
[Mon Apr 06 19:24:37.516310 2026] [:error] [pid 10280:tid 10293] [client 62.197.144.85:39708] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adOX9V8QUJkf8g-BFfPchgAAAco"]
[Mon Apr 06 19:24:38.753032 2026] [:error] [pid 10280:tid 10300] [client 62.197.144.85:39720] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adOX9l8QUJkf8g-BFfPckAAAAdE"]
[Mon Apr 06 19:24:42.098718 2026] [:error] [pid 35686:tid 35704] [client 62.197.144.85:39740] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adOX-sMKdea6oORd2fzJnAAAAAg"]
[Mon Apr 06 19:24:43.358514 2026] [:error] [pid 9442:tid 9454] [client 62.197.144.85:39758] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adOX-0PsNnAJTnmz6safFAAAAQo"]
[Mon Apr 06 19:24:45.010828 2026] [:error] [pid 38562:tid 38578] [client 62.197.144.85:39796] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "adOX_aeD6Ohe6wzRuy5x2gAAAU0"]
[Mon Apr 06 19:24:46.273076 2026] [:error] [pid 10280:tid 10294] [client 62.197.144.85:60308] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adOX_l8QUJkf8g-BFfPctQAAAcs"]
[Mon Apr 06 19:24:48.776178 2026] [:error] [pid 38562:tid 38583] [client 62.197.144.85:60340] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adOYAKeD6Ohe6wzRuy5x7wAAAVI"]
[Mon Apr 06 19:24:50.001006 2026] [:error] [pid 9442:tid 9445] [client 62.197.144.85:60382] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adOYAkPsNnAJTnmz6safRQAAAQE"]
[Mon Apr 06 19:24:51.234866 2026] [:error] [pid 35786:tid 35808] [client 62.197.144.85:60402] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adOYA2gkfCKTaLhwaKQVbgAAAM8"]
[Mon Apr 06 19:24:52.055066 2026] [:error] [pid 9442:tid 9458] [client 62.197.144.85:60424] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adOYBEPsNnAJTnmz6safVQAAAQ4"]
[Mon Apr 06 19:24:52.876369 2026] [:error] [pid 35688:tid 35774] [client 62.197.144.85:60436] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adOYBOZ85qg4jLsRpQyIgwAAAJg"]
[Mon Apr 06 19:24:54.923800 2026] [:error] [pid 9442:tid 9453] [client 62.197.144.85:60448] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adOYBkPsNnAJTnmz6safZAAAAQk"]
[Mon Apr 06 19:24:55.766189 2026] [:error] [pid 35786:tid 35812] [client 62.197.144.85:57614] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "adOYB2gkfCKTaLhwaKQVbwAAANM"]
[Mon Apr 06 19:24:56.586932 2026] [:error] [pid 35688:tid 35751] [client 62.197.144.85:57648] [client 62.197.144.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adOYCOZ85qg4jLsRpQyIlwAAAIE"]
[Mon Apr 06 19:24:57.413043 2026] [:error] [pid 35688:tid 35761] [client 62.197.144.85:57672] [client 62.197.144.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "adOYCeZ85qg4jLsRpQyIngAAAIs"]
[Mon Apr 06 19:24:58.260020 2026] [:error] [pid 35688:tid 35756] [client 62.197.144.85:57690] [client 62.197.144.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "adOYCuZ85qg4jLsRpQyIpAAAAIY"]
[Mon Apr 06 19:24:59.077966 2026] [:error] [pid 9442:tid 9456] [client 62.197.144.85:57772] [client 62.197.144.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "adOYC0PsNnAJTnmz6saffQAAAQw"]
[Mon Apr 06 19:24:59.891901 2026] [:error] [pid 9442:tid 9449] [client 62.197.144.85:57790] [client 62.197.144.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/chosen.php"] [unique_id "adOYC0PsNnAJTnmz6safiAAAAQU"]
[Mon Apr 06 19:25:14.472774 2026] [:error] [pid 9442:tid 9459] [client 62.197.144.85:57814] [client 62.197.144.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/widgets/"] [unique_id "adOYGkPsNnAJTnmz6saf-wAAAQ8"]
[Mon Apr 06 19:25:15.297706 2026] [:error] [pid 9442:tid 9446] [client 62.197.144.85:52964] [client 62.197.144.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/widgets/"] [unique_id "adOYG0PsNnAJTnmz6sagAwAAAQI"]
[Mon Apr 06 19:25:16.538961 2026] [:error] [pid 9442:tid 9465] [client 62.197.144.85:50066] [client 62.197.144.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "adOYHEPsNnAJTnmz6sagDgAAARU"]
[Mon Apr 06 19:25:17.380131 2026] [:error] [pid 35688:tid 35760] [client 62.197.144.85:50094] [client 62.197.144.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "adOYHeZ85qg4jLsRpQyI2QAAAIo"]
[Mon Apr 06 19:25:18.200744 2026] [:error] [pid 10280:tid 10301] [client 62.197.144.85:50126] [client 62.197.144.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "adOYHl8QUJkf8g-BFfPdLgAAAdI"]
[Mon Apr 06 19:25:19.032773 2026] [:error] [pid 9442:tid 9454] [client 62.197.144.85:50130] [client 62.197.144.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "adOYH0PsNnAJTnmz6sagNAAAAQo"]
[Mon Apr 06 19:25:19.851409 2026] [:error] [pid 1827:tid 1840] [client 62.197.144.85:50152] [client 62.197.144.85] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-file-manager/admin/"] [unique_id "adOYH-Veb6S_DnjZ2xEBLwAAAgs"]
[Mon Apr 06 22:21:50.510224 2026] [:error] [pid 9442:tid 9446] [client 45.55.200.95:54200] [client 45.55.200.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adPBfkPsNnAJTnmz6sYwmgAAAQI"]
[Mon Apr 06 22:21:51.347932 2026] [:error] [pid 9442:tid 9462] [client 45.55.200.95:40980] [client 45.55.200.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adPBf0PsNnAJTnmz6sYwnwAAARI"]
[Mon Apr 06 23:25:55.922777 2026] [:error] [pid 35688:tid 35773] [client 45.55.200.95:35090] [client 45.55.200.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adPQg-Z85qg4jLsRpQwTYgAAAJc"]
[Mon Apr 06 23:25:57.603672 2026] [:error] [pid 35687:tid 35735] [client 45.55.200.95:43322] [client 45.55.200.95] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adPQhZ3LtDozV0i8BiuMZQAAAEw"]
[Tue Apr 07 05:31:08.438620 2026] [:error] [pid 37598:tid 37679] [client 86.38.98.84:53550] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adQmHO9g7q_cV2WhPaxwjgAAAJI"]
[Tue Apr 07 05:31:09.876249 2026] [:error] [pid 12948:tid 12972] [client 86.38.98.84:42142] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adQmHcbeSPAN8LvMqsb6VAAAARU"]
[Tue Apr 07 05:31:12.251753 2026] [:error] [pid 12948:tid 12961] [client 86.38.98.84:42146] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adQmIMbeSPAN8LvMqsb6ZQAAAQo"]
[Tue Apr 07 05:31:13.692652 2026] [:error] [pid 37719:tid 37744] [client 86.38.98.84:42162] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "adQmIU09Xv52u2xXGLAZOgAAANY"]
[Tue Apr 07 05:31:16.031984 2026] [:error] [pid 37598:tid 37675] [client 86.38.98.84:39516] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adQmJO9g7q_cV2WhPaxwmgAAAI4"]
[Tue Apr 07 05:31:16.841503 2026] [:error] [pid 37598:tid 37679] [client 86.38.98.84:39522] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adQmJO9g7q_cV2WhPaxwngAAAJI"]
[Tue Apr 07 05:31:17.409726 2026] [:error] [pid 37719:tid 37732] [client 86.38.98.84:39532] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adQmJU09Xv52u2xXGLAZPwAAAMo"]
[Tue Apr 07 05:31:17.983931 2026] [:error] [pid 37719:tid 37728] [client 86.38.98.84:39540] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adQmJU09Xv52u2xXGLAZQgAAAMY"]
[Tue Apr 07 05:31:18.563208 2026] [:error] [pid 37598:tid 37685] [client 86.38.98.84:39544] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adQmJu9g7q_cV2WhPaxwoAAAAJg"]
[Tue Apr 07 05:31:19.131926 2026] [:error] [pid 37597:tid 37649] [client 86.38.98.84:39556] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adQmJw6uAY0QAy-8EEI8nQAAAE8"]
[Tue Apr 07 05:31:20.011930 2026] [:error] [pid 37597:tid 37657] [client 86.38.98.84:39572] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adQmKA6uAY0QAy-8EEI8oQAAAFc"]
[Tue Apr 07 05:31:21.156301 2026] [:error] [pid 37719:tid 37727] [client 86.38.98.84:39576] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "adQmKU09Xv52u2xXGLAZTwAAAMU"]
[Tue Apr 07 05:31:22.279645 2026] [:error] [pid 37598:tid 37677] [client 86.38.98.84:39590] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adQmKu9g7q_cV2WhPaxwtwAAAJA"]
[Tue Apr 07 05:31:23.146758 2026] [:error] [pid 37719:tid 37736] [client 86.38.98.84:39592] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adQmK009Xv52u2xXGLAZVwAAAM4"]
[Tue Apr 07 05:31:23.953338 2026] [:error] [pid 37596:tid 37629] [client 86.38.98.84:39598] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adQmK6paAOZHEjRWjP3rNwAAABc"]
[Tue Apr 07 05:31:26.112566 2026] [:error] [pid 12948:tid 12962] [client 86.38.98.84:51200] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adQmLsbeSPAN8LvMqsb6eAAAAQs"]
[Tue Apr 07 05:31:26.981512 2026] [:error] [pid 37598:tid 37683] [client 86.38.98.84:51202] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adQmLu9g7q_cV2WhPaxwxwAAAJY"]
[Tue Apr 07 05:31:28.065400 2026] [:error] [pid 37598:tid 37668] [client 86.38.98.84:51208] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "adQmMO9g7q_cV2WhPaxwzQAAAIc"]
[Tue Apr 07 05:31:28.942457 2026] [:error] [pid 37597:tid 37654] [client 86.38.98.84:51218] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adQmMA6uAY0QAy-8EEI8qwAAAFQ"]
[Tue Apr 07 05:31:30.742362 2026] [:error] [pid 37596:tid 37619] [client 86.38.98.84:51226] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adQmMqpaAOZHEjRWjP3rYAAAAA0"]
[Tue Apr 07 05:31:31.535546 2026] [:error] [pid 37719:tid 37731] [client 86.38.98.84:51228] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adQmM009Xv52u2xXGLAZZAAAAMk"]
[Tue Apr 07 05:31:32.400011 2026] [:error] [pid 12948:tid 12965] [client 86.38.98.84:51238] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adQmNMbeSPAN8LvMqsb6hgAAAQ4"]
[Tue Apr 07 05:31:32.968834 2026] [:error] [pid 12948:tid 12954] [client 86.38.98.84:51242] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adQmNMbeSPAN8LvMqsb6hwAAAQM"]
[Tue Apr 07 05:31:33.495203 2026] [:error] [pid 12948:tid 12964] [client 86.38.98.84:51256] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adQmNcbeSPAN8LvMqsb6igAAAQ0"]
[Tue Apr 07 05:31:35.047880 2026] [:error] [pid 37596:tid 37619] [client 86.38.98.84:51892] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adQmN6paAOZHEjRWjP3reQAAAA0"]
[Tue Apr 07 05:31:35.616373 2026] [:error] [pid 12948:tid 12951] [client 86.38.98.84:51904] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "adQmN8beSPAN8LvMqsb6kwAAAQA"]
[Tue Apr 07 05:31:36.184806 2026] [:error] [pid 12948:tid 12959] [client 86.38.98.84:36549] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adQmOMbeSPAN8LvMqsb6lgAAAQg"]
[Tue Apr 07 05:31:39.213750 2026] [:error] [pid 12948:tid 12951] [client 86.38.98.84:51928] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/admin.php"] [unique_id "adQmO8beSPAN8LvMqsb6tQAAAQA"]
[Tue Apr 07 05:31:40.848889 2026] [:error] [pid 37719:tid 37728] [client 86.38.98.84:51932] [client 86.38.98.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 86.38.98.84, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adQmPE09Xv52u2xXGLAZcwAAAMY"]
[Tue Apr 07 05:31:44.308680 2026] [:error] [pid 37719:tid 37732] [client 86.38.98.84:51932] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adQmQE09Xv52u2xXGLAZhQAAAMo"]
[Tue Apr 07 05:31:45.456446 2026] [:error] [pid 12948:tid 12964] [client 86.38.98.84:50020] [client 86.38.98.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 86.38.98.84, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adQmQcbeSPAN8LvMqsb6zgAAAQ0"]
[Tue Apr 07 05:31:46.034296 2026] [:error] [pid 12948:tid 12962] [client 86.38.98.84:50020] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/item.php"] [unique_id "adQmQsbeSPAN8LvMqsb60QAAAQs"]
[Tue Apr 07 05:31:48.695889 2026] [:error] [pid 37597:tid 37642] [client 86.38.98.84:50030] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adQmRA6uAY0QAy-8EEI87QAAAEg"]
[Tue Apr 07 05:31:51.391771 2026] [:error] [pid 37596:tid 37606] [client 86.38.98.84:50042] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adQmR6paAOZHEjRWjP3rlAAAAAA"]
[Tue Apr 07 05:31:52.472484 2026] [:error] [pid 12948:tid 12958] [client 86.38.98.84:50050] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adQmSMbeSPAN8LvMqsb62AAAAQc"]
[Tue Apr 07 05:31:53.818170 2026] [:error] [pid 12948:tid 12975] [client 86.38.98.84:50066] [client 86.38.98.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 86.38.98.84, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adQmScbeSPAN8LvMqsb64gAAARg"]
[Tue Apr 07 05:31:54.086229 2026] [:error] [pid 12948:tid 12969] [client 86.38.98.84:50066] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adQmSsbeSPAN8LvMqsb65gAAARI"]
[Tue Apr 07 05:31:59.392831 2026] [:error] [pid 12948:tid 12969] [client 86.38.98.84:36268] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adQmT8beSPAN8LvMqsb7CQAAARI"]
[Tue Apr 07 05:32:00.781447 2026] [:error] [pid 12948:tid 12970] [client 86.38.98.84:36284] [client 86.38.98.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 86.38.98.84, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adQmUMbeSPAN8LvMqsb7EAAAARM"]
[Tue Apr 07 05:32:02.194924 2026] [:error] [pid 12948:tid 12951] [client 86.38.98.84:36284] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adQmUsbeSPAN8LvMqsb7FgAAAQA"]
[Tue Apr 07 05:32:03.053414 2026] [:error] [pid 12948:tid 12975] [client 86.38.98.84:36290] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/infi.php"] [unique_id "adQmU8beSPAN8LvMqsb7GwAAARg"]
[Tue Apr 07 05:32:04.195299 2026] [:error] [pid 12948:tid 12973] [client 86.38.98.84:36306] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adQmVMbeSPAN8LvMqsb7IAAAARY"]
[Tue Apr 07 05:32:05.633275 2026] [:error] [pid 37719:tid 37741] [client 86.38.98.84:50984] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adQmVU09Xv52u2xXGLAZwgAAANM"]
[Tue Apr 07 05:32:06.219284 2026] [:error] [pid 37719:tid 37736] [client 86.38.98.84:50992] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adQmVk09Xv52u2xXGLAZxAAAAM4"]
[Tue Apr 07 05:32:08.225599 2026] [:error] [pid 37719:tid 37739] [client 86.38.98.84:51000] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adQmWE09Xv52u2xXGLAZzgAAANE"]
[Tue Apr 07 05:32:09.085686 2026] [:error] [pid 12948:tid 12962] [client 86.38.98.84:51004] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adQmWcbeSPAN8LvMqsb7MwAAAQs"]
[Tue Apr 07 05:32:10.427182 2026] [:error] [pid 12948:tid 12974] [client 86.38.98.84:51010] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/edit.php"] [unique_id "adQmWsbeSPAN8LvMqsb7OwAAARc"]
[Tue Apr 07 05:32:11.865869 2026] [:error] [pid 37597:tid 37646] [client 86.38.98.84:51024] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adQmWw6uAY0QAy-8EEI9RgAAAEw"]
[Tue Apr 07 05:32:13.009636 2026] [:error] [pid 12948:tid 12962] [client 86.38.98.84:51028] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/click.php"] [unique_id "adQmXcbeSPAN8LvMqsb7SAAAAQs"]
[Tue Apr 07 05:32:14.463970 2026] [:error] [pid 37598:tid 37667] [client 86.38.98.84:51044] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adQmXu9g7q_cV2WhPaxxQAAAAIY"]
[Tue Apr 07 05:32:17.090685 2026] [:error] [pid 37597:tid 37641] [client 86.38.98.84:33756] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adQmYQ6uAY0QAy-8EEI9aAAAAEc"]
[Tue Apr 07 05:32:17.659230 2026] [:error] [pid 37598:tid 37668] [client 86.38.98.84:33760] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adQmYe9g7q_cV2WhPaxxRQAAAIc"]
[Tue Apr 07 05:32:18.183382 2026] [:error] [pid 37597:tid 37658] [client 86.38.98.84:33770] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adQmYg6uAY0QAy-8EEI9bQAAAFg"]
[Tue Apr 07 05:32:18.752780 2026] [:error] [pid 12948:tid 12964] [client 86.38.98.84:33780] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adQmYsbeSPAN8LvMqsb7XQAAAQ0"]
[Tue Apr 07 05:32:19.642624 2026] [:error] [pid 12948:tid 12956] [client 86.38.98.84:33794] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adQmY8beSPAN8LvMqsb7ZAAAAQU"]
[Tue Apr 07 05:32:20.174273 2026] [:error] [pid 37598:tid 37662] [client 86.38.98.84:33808] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adQmZO9g7q_cV2WhPaxxSQAAAIE"]
[Tue Apr 07 05:32:21.323904 2026] [:error] [pid 37597:tid 37650] [client 86.38.98.84:33810] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adQmZQ6uAY0QAy-8EEI9dgAAAFA"]
[Tue Apr 07 05:32:21.853127 2026] [:error] [pid 37719:tid 37736] [client 86.38.98.84:33820] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "adQmZU09Xv52u2xXGLAZ4AAAAM4"]
[Tue Apr 07 05:32:22.375744 2026] [:error] [pid 37719:tid 37730] [client 86.38.98.84:33836] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adQmZk09Xv52u2xXGLAZ4gAAAMg"]
[Tue Apr 07 05:32:22.912522 2026] [:error] [pid 37598:tid 37665] [client 86.38.98.84:33840] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "adQmZu9g7q_cV2WhPaxxVAAAAIQ"]
[Tue Apr 07 05:32:23.714494 2026] [:error] [pid 37598:tid 37682] [client 86.38.98.84:33844] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adQmZ-9g7q_cV2WhPaxxWAAAAJU"]
[Tue Apr 07 05:32:24.945889 2026] [:error] [pid 37597:tid 37643] [client 86.38.98.84:60272] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adQmaA6uAY0QAy-8EEI9gwAAAEk"]
[Tue Apr 07 05:32:26.537990 2026] [:error] [pid 12948:tid 12960] [client 86.38.98.84:60286] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adQmasbeSPAN8LvMqsb7gAAAAQk"]
[Tue Apr 07 05:32:33.778708 2026] [:error] [pid 12948:tid 12956] [client 86.38.98.84:60298] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "adQmccbeSPAN8LvMqsb7sQAAAQU"]
[Tue Apr 07 05:32:35.270857 2026] [:error] [pid 37596:tid 37611] [client 86.38.98.84:47728] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adQmc6paAOZHEjRWjP3r6QAAAAU"]
[Tue Apr 07 05:32:35.843407 2026] [:error] [pid 37598:tid 37681] [client 86.38.98.84:47736] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adQmc-9g7q_cV2WhPaxxdAAAAJQ"]
[Tue Apr 07 05:32:37.463372 2026] [:error] [pid 37596:tid 37626] [client 86.38.98.84:47750] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adQmdapaAOZHEjRWjP3r-AAAABQ"]
[Tue Apr 07 05:32:38.813319 2026] [proxy_fcgi:error] [pid 37719:tid 37728] [client 86.38.98.84:47754] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:32:39.090043 2026] [proxy_fcgi:error] [pid 37719:tid 37739] [client 86.38.98.84:47754] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:32:39.367348 2026] [proxy_fcgi:error] [pid 37719:tid 37722] [client 86.38.98.84:47754] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:32:40.733545 2026] [:error] [pid 37719:tid 37728] [client 86.38.98.84:47754] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "adQmeE09Xv52u2xXGLAaCwAAAMY"]
[Tue Apr 07 05:32:41.270019 2026] [:error] [pid 37719:tid 37744] [client 86.38.98.84:47766] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adQmeU09Xv52u2xXGLAaDgAAANY"]
[Tue Apr 07 05:32:41.897964 2026] [:error] [pid 37598:tid 37682] [client 86.38.98.84:47780] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adQmee9g7q_cV2WhPaxxfAAAAJU"]
[Tue Apr 07 05:32:42.437013 2026] [:error] [pid 37719:tid 37731] [client 86.38.98.84:47790] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adQmek09Xv52u2xXGLAaEQAAAMk"]
[Tue Apr 07 05:32:42.976331 2026] [:error] [pid 37598:tid 37683] [client 86.38.98.84:47802] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adQmeu9g7q_cV2WhPaxxfgAAAJY"]
[Tue Apr 07 05:32:43.559922 2026] [:error] [pid 37596:tid 37619] [client 86.38.98.84:47812] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adQme6paAOZHEjRWjP3sEwAAAA0"]
[Tue Apr 07 05:32:44.430844 2026] [:error] [pid 37598:tid 37685] [client 86.38.98.84:54478] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "adQmfO9g7q_cV2WhPaxxgAAAAJg"]
[Tue Apr 07 05:32:46.447831 2026] [:error] [pid 12948:tid 12961] [client 86.38.98.84:54494] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adQmfsbeSPAN8LvMqsb7yAAAAQo"]
[Tue Apr 07 05:32:46.988370 2026] [:error] [pid 12948:tid 12973] [client 86.38.98.84:54504] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adQmfsbeSPAN8LvMqsb7zAAAARY"]
[Tue Apr 07 05:32:47.569624 2026] [:error] [pid 37597:tid 37637] [client 86.38.98.84:54506] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adQmfw6uAY0QAy-8EEI9wgAAAEM"]
[Tue Apr 07 05:32:48.736623 2026] [:error] [pid 37597:tid 37658] [client 86.38.98.84:54510] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adQmgA6uAY0QAy-8EEI9xgAAAFg"]
[Tue Apr 07 05:32:49.554342 2026] [:error] [pid 37719:tid 37736] [client 86.38.98.84:54524] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "adQmgU09Xv52u2xXGLAaLQAAAM4"]
[Tue Apr 07 05:32:50.712932 2026] [:error] [pid 12948:tid 12962] [client 86.38.98.84:54538] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adQmgsbeSPAN8LvMqsb75QAAAQs"]
[Tue Apr 07 05:32:51.854028 2026] [:error] [pid 37597:tid 37650] [client 86.38.98.84:54550] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "adQmgw6uAY0QAy-8EEI9ywAAAFA"]
[Tue Apr 07 05:32:53.292718 2026] [:error] [pid 12948:tid 12973] [client 86.38.98.84:54566] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adQmhcbeSPAN8LvMqsb7-wAAARY"]
[Tue Apr 07 05:32:56.246298 2026] [:error] [pid 37719:tid 37744] [client 86.38.98.84:54568] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "adQmiE09Xv52u2xXGLAaRwAAANY"]
[Tue Apr 07 05:32:57.044677 2026] [:error] [pid 37596:tid 37607] [client 86.38.98.84:36324] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "adQmiapaAOZHEjRWjP3sPQAAAAE"]
[Tue Apr 07 05:33:02.042122 2026] [:error] [pid 37597:tid 37651] [client 86.38.98.84:36336] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adQmjg6uAY0QAy-8EEI96wAAAFE"]
[Tue Apr 07 05:33:02.656539 2026] [:error] [pid 12948:tid 12959] [client 86.38.98.84:36350] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adQmjsbeSPAN8LvMqsb8HgAAAQg"]
[Tue Apr 07 05:33:03.443612 2026] [:error] [pid 37596:tid 37608] [client 86.38.98.84:36362] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adQmj6paAOZHEjRWjP3sUgAAAAI"]
[Tue Apr 07 05:33:04.580016 2026] [:error] [pid 37598:tid 37675] [client 86.38.98.84:60666] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adQmkO9g7q_cV2WhPaxxsgAAAI4"]
[Tue Apr 07 05:33:05.109064 2026] [:error] [pid 37719:tid 37734] [client 86.38.98.84:60672] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adQmkU09Xv52u2xXGLAaiwAAAMw"]
[Tue Apr 07 05:33:06.700817 2026] [:error] [pid 37598:tid 37685] [client 86.38.98.84:6541] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adQmku9g7q_cV2WhPaxxvgAAAJg"]
[Tue Apr 07 05:33:07.267488 2026] [:error] [pid 37598:tid 37681] [client 86.38.98.84:60694] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "adQmk-9g7q_cV2WhPaxxwAAAAJQ"]
[Tue Apr 07 05:33:09.318603 2026] [:error] [pid 12948:tid 12964] [client 86.38.98.84:60710] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adQmlcbeSPAN8LvMqsb8LwAAAQ0"]
[Tue Apr 07 05:33:10.181297 2026] [proxy_fcgi:error] [pid 37597:tid 37640] [client 86.38.98.84:60718] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:33:10.756062 2026] [:error] [pid 37597:tid 37636] [client 86.38.98.84:60718] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/function.php"] [unique_id "adQmlg6uAY0QAy-8EEI9_gAAAEI"]
[Tue Apr 07 05:33:11.288489 2026] [:error] [pid 12948:tid 12953] [client 86.38.98.84:60732] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "adQml8beSPAN8LvMqsb8MQAAAQI"]
[Tue Apr 07 05:33:12.427313 2026] [:error] [pid 37596:tid 37630] [client 86.38.98.84:60746] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "adQmmKpaAOZHEjRWjP3sdwAAABg"]
[Tue Apr 07 05:33:13.004311 2026] [:error] [pid 12948:tid 12962] [client 86.38.98.84:60758] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adQmmcbeSPAN8LvMqsb8OQAAAQs"]
[Tue Apr 07 05:33:15.482447 2026] [:error] [pid 37597:tid 37651] [client 86.38.98.84:60760] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "adQmmw6uAY0QAy-8EEI-CgAAAFE"]
[Tue Apr 07 05:33:16.049026 2026] [:error] [pid 12948:tid 12967] [client 86.38.98.84:45118] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adQmnMbeSPAN8LvMqsb8PgAAARA"]
[Tue Apr 07 05:33:17.645441 2026] [:error] [pid 37598:tid 37683] [client 86.38.98.84:45120] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "adQmne9g7q_cV2WhPaxx0wAAAJY"]
[Tue Apr 07 05:33:18.214252 2026] [:error] [pid 12948:tid 12969] [client 86.38.98.84:45126] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adQmnsbeSPAN8LvMqsb8RQAAARI"]
[Tue Apr 07 05:33:18.768712 2026] [:error] [pid 37719:tid 37723] [client 86.38.98.84:45128] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adQmnk09Xv52u2xXGLAarQAAAME"]
[Tue Apr 07 05:33:20.805824 2026] [:error] [pid 12948:tid 12953] [client 86.38.98.84:45142] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adQmoMbeSPAN8LvMqsb8UgAAAQI"]
[Tue Apr 07 05:33:21.612106 2026] [:error] [pid 12948:tid 12968] [client 86.38.98.84:45156] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adQmocbeSPAN8LvMqsb8VAAAARE"]
[Tue Apr 07 05:33:25.322737 2026] [:error] [pid 12948:tid 12967] [client 86.38.98.84:45172] [client 86.38.98.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 86.38.98.84, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/js/wp-login.php"] [unique_id "adQmpcbeSPAN8LvMqsb8bwAAARA"]
[Tue Apr 07 05:33:26.939740 2026] [:error] [pid 12948:tid 12975] [client 86.38.98.84:45172] [client 86.38.98.84] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 86.38.98.84, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adQmpsbeSPAN8LvMqsb8egAAARg"]
[Tue Apr 07 05:33:29.944724 2026] [proxy_fcgi:error] [pid 12948:tid 12972] [client 86.38.98.84:45172] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:33:34.056220 2026] [:error] [pid 12948:tid 12972] [client 86.38.98.84:45172] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adQmrsbeSPAN8LvMqsb8twAAARU"]
[Tue Apr 07 05:33:35.391430 2026] [:error] [pid 12948:tid 12965] [client 86.38.98.84:59552] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adQmr8beSPAN8LvMqsb8vgAAAQ4"]
[Tue Apr 07 05:33:36.452035 2026] [:error] [pid 37719:tid 37737] [client 86.38.98.84:59556] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adQmsE09Xv52u2xXGLAa5QAAAM8"]
[Tue Apr 07 05:33:39.462670 2026] [:error] [pid 37598:tid 37677] [client 86.38.98.84:59560] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adQms-9g7q_cV2WhPaxyDgAAAJA"]
[Tue Apr 07 05:33:40.512296 2026] [:error] [pid 37597:tid 37643] [client 86.38.98.84:59564] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adQmtA6uAY0QAy-8EEI-LAAAAEk"]
[Tue Apr 07 05:33:41.365910 2026] [:error] [pid 37597:tid 37645] [client 86.38.98.84:59566] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adQmtQ6uAY0QAy-8EEI-NAAAAEs"]
[Tue Apr 07 05:33:43.104500 2026] [proxy_fcgi:error] [pid 37596:tid 37607] [client 86.38.98.84:59582] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:33:43.393154 2026] [proxy_fcgi:error] [pid 37596:tid 37624] [client 86.38.98.84:59582] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:33:43.678588 2026] [:error] [pid 37596:tid 37625] [client 86.38.98.84:59582] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "adQmt6paAOZHEjRWjP3s5gAAABM"]
[Tue Apr 07 05:33:44.208211 2026] [:error] [pid 37596:tid 37621] [client 86.38.98.84:59544] [client 86.38.98.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "adQmuKpaAOZHEjRWjP3s5wAAAA8"]
[Tue Apr 07 05:33:52.089543 2026] [:error] [pid 37597:tid 37644] [client 217.138.216.222:59558] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "adQmwA6uAY0QAy-8EEI-XgAAAEo"]
[Tue Apr 07 05:33:54.448842 2026] [:error] [pid 37598:tid 37676] [client 217.138.216.222:51870] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "adQmwu9g7q_cV2WhPaxyigAAAI8"]
[Tue Apr 07 05:33:55.924487 2026] [:error] [pid 37719:tid 37736] [client 217.138.216.222:51872] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adQmw009Xv52u2xXGLAbBgAAAM4"]
[Tue Apr 07 05:33:58.590681 2026] [:error] [pid 12948:tid 12957] [client 217.138.216.222:51882] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "adQmxsbeSPAN8LvMqsb8-gAAAQY"]
[Tue Apr 07 05:33:59.183676 2026] [proxy_fcgi:error] [pid 12948:tid 12960] [client 217.138.216.222:51884] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:34:00.114172 2026] [:error] [pid 12948:tid 12972] [client 217.138.216.222:51884] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adQmyMbeSPAN8LvMqsb9BQAAARU"]
[Tue Apr 07 05:34:02.203488 2026] [proxy_fcgi:error] [pid 37719:tid 37745] [client 217.138.216.222:51890] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:34:02.789879 2026] [:error] [pid 37719:tid 37738] [client 217.138.216.222:51890] [client 217.138.216.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.216.222, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "adQmyk09Xv52u2xXGLAbJAAAANA"]
[Tue Apr 07 05:34:04.269626 2026] [:error] [pid 37719:tid 37727] [client 217.138.216.222:51890] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "adQmzE09Xv52u2xXGLAbLAAAAMU"]
[Tue Apr 07 05:34:05.175935 2026] [:error] [pid 12948:tid 12966] [client 217.138.216.222:46726] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "adQmzcbeSPAN8LvMqsb9JAAAAQ8"]
[Tue Apr 07 05:34:07.760116 2026] [:error] [pid 37597:tid 37656] [client 217.138.216.222:46742] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "adQmzw6uAY0QAy-8EEI-fQAAAFY"]
[Tue Apr 07 05:34:09.222126 2026] [:error] [pid 37598:tid 37685] [client 217.138.216.222:53722] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "adQm0e9g7q_cV2WhPaxyzgAAAJg"]
[Tue Apr 07 05:34:09.807992 2026] [:error] [pid 37598:tid 37682] [client 217.138.216.222:46758] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "adQm0e9g7q_cV2WhPaxy0wAAAJU"]
[Tue Apr 07 05:34:11.271573 2026] [:error] [pid 37719:tid 37738] [client 217.138.216.222:46772] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "adQm0009Xv52u2xXGLAbPgAAANA"]
[Tue Apr 07 05:34:12.439199 2026] [proxy_fcgi:error] [pid 37719:tid 37745] [client 217.138.216.222:46776] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:34:12.726032 2026] [:error] [pid 37719:tid 37741] [client 217.138.216.222:46776] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "adQm1E09Xv52u2xXGLAbSAAAANM"]
[Tue Apr 07 05:34:13.625361 2026] [:error] [pid 37598:tid 37677] [client 217.138.216.222:46782] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/db.php"] [unique_id "adQm1e9g7q_cV2WhPaxy6gAAAJA"]
[Tue Apr 07 05:34:14.215656 2026] [:error] [pid 12948:tid 12963] [client 217.138.216.222:53040] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "adQm1sbeSPAN8LvMqsb9SgAAAQw"]
[Tue Apr 07 05:34:14.807643 2026] [:error] [pid 37596:tid 37606] [client 217.138.216.222:53052] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "adQm1qpaAOZHEjRWjP3tCAAAAAA"]
[Tue Apr 07 05:34:15.383949 2026] [:error] [pid 37596:tid 37617] [client 217.138.216.222:53060] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "adQm16paAOZHEjRWjP3tCwAAAAs"]
[Tue Apr 07 05:34:15.975688 2026] [:error] [pid 37719:tid 37738] [client 217.138.216.222:53074] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "adQm1009Xv52u2xXGLAbUgAAANA"]
[Tue Apr 07 05:34:16.564477 2026] [:error] [pid 37598:tid 37665] [client 217.138.216.222:53078] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "adQm2O9g7q_cV2WhPaxy9AAAAIQ"]
[Tue Apr 07 05:34:17.740514 2026] [:error] [pid 37597:tid 37657] [client 217.138.216.222:53088] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "adQm2Q6uAY0QAy-8EEI-iQAAAFc"]
[Tue Apr 07 05:34:18.319091 2026] [:error] [pid 37597:tid 37646] [client 217.138.216.222:53098] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "adQm2g6uAY0QAy-8EEI-iwAAAEw"]
[Tue Apr 07 05:34:18.900406 2026] [:error] [pid 37596:tid 37623] [client 217.138.216.222:53114] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "adQm2qpaAOZHEjRWjP3tFAAAABE"]
[Tue Apr 07 05:34:19.480673 2026] [:error] [pid 37719:tid 37738] [client 217.138.216.222:53120] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "adQm2009Xv52u2xXGLAbWwAAANA"]
[Tue Apr 07 05:34:20.078727 2026] [:error] [pid 12948:tid 12951] [client 217.138.216.222:53126] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "adQm3MbeSPAN8LvMqsb9ZwAAAQA"]
[Tue Apr 07 05:34:20.663886 2026] [proxy_fcgi:error] [pid 12948:tid 12963] [client 217.138.216.222:53132] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:34:21.540761 2026] [:error] [pid 12948:tid 12961] [client 217.138.216.222:53132] [client 217.138.216.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.216.222, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "adQm3cbeSPAN8LvMqsb9eAAAAQo"]
[Tue Apr 07 05:34:23.008059 2026] [:error] [pid 12948:tid 12967] [client 217.138.216.222:53132] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "adQm38beSPAN8LvMqsb9iwAAARA"]
[Tue Apr 07 05:34:28.326645 2026] [:error] [pid 37596:tid 37617] [client 217.138.216.222:53138] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adQm5KpaAOZHEjRWjP3tQAAAAAs"]
[Tue Apr 07 05:34:28.912764 2026] [:error] [pid 37597:tid 37655] [client 217.138.216.222:34400] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "adQm5A6uAY0QAy-8EEI-mQAAAFU"]
[Tue Apr 07 05:34:29.502085 2026] [:error] [pid 37719:tid 37737] [client 217.138.216.222:34414] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "adQm5U09Xv52u2xXGLAbZQAAAM8"]
[Tue Apr 07 05:34:31.890408 2026] [:error] [pid 37719:tid 37745] [client 217.138.216.222:34416] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "adQm5009Xv52u2xXGLAbbgAAANc"]
[Tue Apr 07 05:34:32.470930 2026] [:error] [pid 12948:tid 12953] [client 217.138.216.222:34426] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "adQm6MbeSPAN8LvMqsb9wAAAAQI"]
[Tue Apr 07 05:34:33.046724 2026] [:error] [pid 37597:tid 37641] [client 217.138.216.222:34434] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "adQm6Q6uAY0QAy-8EEI-owAAAEc"]
[Tue Apr 07 05:34:34.801228 2026] [:error] [pid 37596:tid 37630] [client 217.138.216.222:34442] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "adQm6qpaAOZHEjRWjP3tTQAAABg"]
[Tue Apr 07 05:34:35.696028 2026] [:error] [pid 37598:tid 37669] [client 217.138.216.222:39254] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "adQm6-9g7q_cV2WhPaxzDwAAAIg"]
[Tue Apr 07 05:34:36.909912 2026] [:error] [pid 37719:tid 37740] [client 217.138.216.222:39270] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "adQm7E09Xv52u2xXGLAbhgAAANI"]
[Tue Apr 07 05:34:41.953162 2026] [:error] [pid 37719:tid 37735] [client 217.138.216.222:39280] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "adQm8U09Xv52u2xXGLAbrAAAAM0"]
[Tue Apr 07 05:34:42.830714 2026] [:error] [pid 12948:tid 12951] [client 217.138.216.222:39294] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/about.php"] [unique_id "adQm8sbeSPAN8LvMqsb9-gAAAQA"]
[Tue Apr 07 05:34:45.197053 2026] [:error] [pid 12948:tid 12964] [client 217.138.216.222:39300] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "adQm9cbeSPAN8LvMqsb-IAAAAQ0"]
[Tue Apr 07 05:34:46.371667 2026] [:error] [pid 37597:tid 37647] [client 217.138.216.222:55492] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "adQm9g6uAY0QAy-8EEI-wQAAAE0"]
[Tue Apr 07 05:34:48.160560 2026] [:error] [pid 37598:tid 37675] [client 217.138.216.222:55496] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "adQm-O9g7q_cV2WhPaxzIwAAAI4"]
[Tue Apr 07 05:34:49.924435 2026] [:error] [pid 37596:tid 37609] [client 217.138.216.222:55502] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "adQm-apaAOZHEjRWjP3taQAAAAM"]
[Tue Apr 07 05:34:52.437810 2026] [:error] [pid 37596:tid 37622] [client 217.138.216.222:55512] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "adQm_KpaAOZHEjRWjP3tcAAAABA"]
[Tue Apr 07 05:34:53.029222 2026] [:error] [pid 12948:tid 12971] [client 217.138.216.222:55528] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "adQm_cbeSPAN8LvMqsb-QAAAARQ"]
[Tue Apr 07 05:34:55.078779 2026] [:error] [pid 37598:tid 37666] [client 217.138.216.222:55542] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "adQm_-9g7q_cV2WhPaxzQwAAAIU"]
[Tue Apr 07 05:34:57.133697 2026] [:error] [pid 12948:tid 12951] [client 217.138.216.222:35670] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "adQnAcbeSPAN8LvMqsb-UQAAAQA"]
[Tue Apr 07 05:34:58.884078 2026] [:error] [pid 37719:tid 37744] [client 217.138.216.222:35686] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adQnAk09Xv52u2xXGLAb6AAAANY"]
[Tue Apr 07 05:34:59.467607 2026] [:error] [pid 12948:tid 12958] [client 217.138.216.222:35692] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "adQnA8beSPAN8LvMqsb-WQAAAQc"]
[Tue Apr 07 05:35:00.340002 2026] [:error] [pid 12948:tid 12968] [client 217.138.216.222:35694] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "adQnBMbeSPAN8LvMqsb-YAAAARE"]
[Tue Apr 07 05:35:01.566948 2026] [:error] [pid 12948:tid 12972] [client 217.138.216.222:35710] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "adQnBcbeSPAN8LvMqsb-aQAAARU"]
[Tue Apr 07 05:35:02.213923 2026] [:error] [pid 37596:tid 37609] [client 217.138.216.222:35720] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "adQnBqpaAOZHEjRWjP3teAAAAAM"]
[Tue Apr 07 05:35:04.593760 2026] [:error] [pid 12948:tid 12971] [client 217.138.216.222:35728] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "adQnCMbeSPAN8LvMqsb-dwAAARQ"]
[Tue Apr 07 05:35:05.777220 2026] [:error] [pid 12948:tid 12958] [client 217.138.216.222:34652] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "adQnCcbeSPAN8LvMqsb-gQAAAQc"]
[Tue Apr 07 05:35:06.363220 2026] [:error] [pid 12948:tid 12966] [client 217.138.216.222:34662] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "adQnCsbeSPAN8LvMqsb-hAAAAQ8"]
[Tue Apr 07 05:35:07.551040 2026] [:error] [pid 37597:tid 37636] [client 217.138.216.222:34672] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "adQnCw6uAY0QAy-8EEI-6AAAAEI"]
[Tue Apr 07 05:35:08.428117 2026] [:error] [pid 37598:tid 37670] [client 217.138.216.222:34674] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "adQnDO9g7q_cV2WhPaxzbAAAAIk"]
[Tue Apr 07 05:35:10.481304 2026] [:error] [pid 37597:tid 37649] [client 217.138.216.222:34682] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "adQnDg6uAY0QAy-8EEI--wAAAE8"]
[Tue Apr 07 05:35:11.679050 2026] [:error] [pid 37596:tid 37626] [client 217.138.216.222:34698] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "adQnD6paAOZHEjRWjP3tggAAABQ"]
[Tue Apr 07 05:35:12.863558 2026] [:error] [pid 37596:tid 37616] [client 217.138.216.222:34714] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "adQnEKpaAOZHEjRWjP3tiwAAAAo"]
[Tue Apr 07 05:35:13.740672 2026] [:error] [pid 37719:tid 37723] [client 217.138.216.222:34730] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/as.php"] [unique_id "adQnEU09Xv52u2xXGLAcOAAAAME"]
[Tue Apr 07 05:35:14.616274 2026] [:error] [pid 37719:tid 37724] [client 217.138.216.222:40868] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "adQnEk09Xv52u2xXGLAcPQAAAMI"]
[Tue Apr 07 05:35:15.192341 2026] [:error] [pid 37596:tid 37609] [client 217.138.216.222:40884] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/install.php"] [unique_id "adQnE6paAOZHEjRWjP3tjwAAAAM"]
[Tue Apr 07 05:35:15.774142 2026] [:error] [pid 37719:tid 37722] [client 217.138.216.222:40898] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "adQnE009Xv52u2xXGLAcQwAAAMA"]
[Tue Apr 07 05:35:18.122002 2026] [:error] [pid 37719:tid 37735] [client 217.138.216.222:40908] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "adQnFk09Xv52u2xXGLAcVwAAAM0"]
[Tue Apr 07 05:35:19.596131 2026] [:error] [pid 37598:tid 37677] [client 217.138.216.222:40924] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "adQnF-9g7q_cV2WhPaxzhQAAAJA"]
[Tue Apr 07 05:35:20.775862 2026] [:error] [pid 12948:tid 12973] [client 217.138.216.222:40932] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "adQnGMbeSPAN8LvMqsb-sAAAARY"]
[Tue Apr 07 05:35:21.945325 2026] [:error] [pid 12948:tid 12972] [client 217.138.216.222:40944] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "adQnGcbeSPAN8LvMqsb-vAAAARU"]
[Tue Apr 07 05:35:24.043720 2026] [:error] [pid 37596:tid 37625] [client 217.138.216.222:40946] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "adQnHKpaAOZHEjRWjP3tpwAAABM"]
[Tue Apr 07 05:35:24.916958 2026] [:error] [pid 12948:tid 12955] [client 217.138.216.222:42854] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "adQnHMbeSPAN8LvMqsb-xwAAAQQ"]
[Tue Apr 07 05:35:25.790392 2026] [:error] [pid 37596:tid 37621] [client 217.138.216.222:42862] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "adQnHapaAOZHEjRWjP3tqgAAAA8"]
[Tue Apr 07 05:35:26.966742 2026] [:error] [pid 12948:tid 12952] [client 217.138.216.222:42878] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "adQnHsbeSPAN8LvMqsb-0wAAAQE"]
[Tue Apr 07 05:35:29.896351 2026] [:error] [pid 37719:tid 37725] [client 217.138.216.222:42882] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "adQnIU09Xv52u2xXGLAcnQAAAMM"]
[Tue Apr 07 05:35:30.476287 2026] [:error] [pid 12948:tid 12957] [client 217.138.216.222:42896] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "adQnIsbeSPAN8LvMqsb-1gAAAQY"]
[Tue Apr 07 05:35:31.940390 2026] [:error] [pid 12948:tid 12968] [client 217.138.216.222:42908] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "adQnI8beSPAN8LvMqsb-2wAAARE"]
[Tue Apr 07 05:35:32.529157 2026] [:error] [pid 12948:tid 12955] [client 217.138.216.222:42916] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adQnJMbeSPAN8LvMqsb-3gAAAQQ"]
[Tue Apr 07 05:35:33.716370 2026] [:error] [pid 37598:tid 37681] [client 217.138.216.222:42920] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "adQnJe9g7q_cV2WhPaxzpQAAAJQ"]
[Tue Apr 07 05:35:34.293360 2026] [:error] [pid 12948:tid 12968] [client 217.138.216.222:40560] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "adQnJsbeSPAN8LvMqsb-5gAAARE"]
[Tue Apr 07 05:35:34.871280 2026] [:error] [pid 37597:tid 37645] [client 217.138.216.222:40566] [client 217.138.216.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.216.222, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "adQnJg6uAY0QAy-8EEI_FgAAAEs"]
[Tue Apr 07 05:35:34.881028 2026] [proxy_fcgi:error] [pid 37597:tid 37645] [client 217.138.216.222:40566] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:35:35.173980 2026] [:error] [pid 37597:tid 37634] [client 217.138.216.222:40566] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "adQnJw6uAY0QAy-8EEI_GQAAAEA"]
[Tue Apr 07 05:35:36.351882 2026] [:error] [pid 12948:tid 12972] [client 217.138.216.222:40574] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "adQnKMbeSPAN8LvMqsb-_AAAARU"]
[Tue Apr 07 05:35:36.931142 2026] [:error] [pid 37597:tid 37652] [client 217.138.216.222:40590] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/network.php"] [unique_id "adQnKA6uAY0QAy-8EEI_GwAAAFI"]
[Tue Apr 07 05:35:39.573891 2026] [:error] [pid 37719:tid 37723] [client 217.138.216.222:40592] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "adQnK009Xv52u2xXGLAcxAAAAME"]
[Tue Apr 07 05:35:40.160683 2026] [:error] [pid 37596:tid 37626] [client 217.138.216.222:40594] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "adQnLKpaAOZHEjRWjP3tuwAAABQ"]
[Tue Apr 07 05:35:41.335365 2026] [:error] [pid 37597:tid 37652] [client 217.138.216.222:40608] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "adQnLQ6uAY0QAy-8EEI_KwAAAFI"]
[Tue Apr 07 05:35:41.911746 2026] [:error] [pid 12948:tid 12969] [client 217.138.216.222:40612] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "adQnLcbeSPAN8LvMqsb_GgAAARI"]
[Tue Apr 07 05:35:42.489970 2026] [proxy_fcgi:error] [pid 37598:tid 37664] [client 217.138.216.222:40616] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:35:42.779812 2026] [:error] [pid 37598:tid 37675] [client 217.138.216.222:40616] [client 217.138.216.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.216.222, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "adQnLu9g7q_cV2WhPaxzuwAAAI4"]
[Tue Apr 07 05:35:43.366094 2026] [:error] [pid 37598:tid 37672] [client 217.138.216.222:40616] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "adQnL-9g7q_cV2WhPaxzwQAAAIs"]
[Tue Apr 07 05:35:44.854980 2026] [:error] [pid 37596:tid 37625] [client 217.138.216.222:40632] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "adQnMKpaAOZHEjRWjP3txwAAABM"]
[Tue Apr 07 05:35:45.737191 2026] [:error] [pid 37719:tid 37726] [client 217.138.216.222:42076] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "adQnMU09Xv52u2xXGLAczAAAAMQ"]
[Tue Apr 07 05:35:46.322046 2026] [:error] [pid 37719:tid 37728] [client 217.138.216.222:42082] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "adQnMk09Xv52u2xXGLAc0AAAAMY"]
[Tue Apr 07 05:35:47.793093 2026] [:error] [pid 12948:tid 12971] [client 217.138.216.222:42088] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "adQnM8beSPAN8LvMqsb_RwAAARQ"]
[Tue Apr 07 05:35:48.951713 2026] [:error] [pid 12948:tid 12975] [client 217.138.216.222:42094] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "adQnNMbeSPAN8LvMqsb_VwAAARg"]
[Tue Apr 07 05:35:50.721099 2026] [:error] [pid 12948:tid 12954] [client 217.138.216.222:42106] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "adQnNsbeSPAN8LvMqsb_cQAAAQM"]
[Tue Apr 07 05:35:51.305999 2026] [:error] [pid 12948:tid 12955] [client 217.138.216.222:42108] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "adQnN8beSPAN8LvMqsb_dgAAAQQ"]
[Tue Apr 07 05:35:52.181495 2026] [:error] [pid 37719:tid 37731] [client 217.138.216.222:42120] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/count.php"] [unique_id "adQnOE09Xv52u2xXGLAc1QAAAMk"]
[Tue Apr 07 05:35:54.534537 2026] [:error] [pid 37597:tid 37657] [client 217.138.216.222:42136] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "adQnOg6uAY0QAy-8EEI_PwAAAFc"]
[Tue Apr 07 05:35:55.714420 2026] [:error] [pid 37596:tid 37611] [client 217.138.216.222:58106] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "paramountestate.com.au"] [uri "/images/stories/themes.php"] [unique_id "adQnO6paAOZHEjRWjP3t1QAAAAU"]
[Tue Apr 07 05:35:56.004068 2026] [:error] [pid 37596:tid 37626] [client 217.138.216.222:58106] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "adQnPKpaAOZHEjRWjP3t1wAAABQ"]
[Tue Apr 07 05:35:57.158771 2026] [:error] [pid 37598:tid 37679] [client 217.138.216.222:58118] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "adQnPe9g7q_cV2WhPaxz3wAAAJI"]
[Tue Apr 07 05:35:57.733485 2026] [:error] [pid 37596:tid 37614] [client 217.138.216.222:58126] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "adQnPapaAOZHEjRWjP3t2QAAAAg"]
[Tue Apr 07 05:36:00.092094 2026] [:error] [pid 37719:tid 37729] [client 217.138.216.222:58140] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "adQnQE09Xv52u2xXGLAc5gAAAMc"]
[Tue Apr 07 05:36:02.686424 2026] [:error] [pid 37597:tid 37640] [client 217.138.216.222:58144] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "adQnQg6uAY0QAy-8EEI_XQAAAEY"]
[Tue Apr 07 05:36:03.561804 2026] [:error] [pid 37596:tid 37615] [client 217.138.216.222:58150] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "adQnQ6paAOZHEjRWjP3t6AAAAAk"]
[Tue Apr 07 05:36:05.643788 2026] [:error] [pid 37719:tid 37732] [client 217.138.216.222:33960] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "adQnRU09Xv52u2xXGLAdBQAAAMo"]
[Tue Apr 07 05:36:06.225428 2026] [:error] [pid 12948:tid 12954] [client 217.138.216.222:33976] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/colour.php"] [unique_id "adQnRsbeSPAN8LvMqsb_0wAAAQM"]
[Tue Apr 07 05:36:07.095564 2026] [:error] [pid 37598:tid 37678] [client 217.138.216.222:33982] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "adQnR-9g7q_cV2WhPaxz8wAAAJE"]
[Tue Apr 07 05:36:07.677097 2026] [:error] [pid 37719:tid 37734] [client 217.138.216.222:33998] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "adQnR009Xv52u2xXGLAdDAAAAMw"]
[Tue Apr 07 05:36:08.837084 2026] [:error] [pid 37719:tid 37739] [client 217.138.216.222:34004] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "adQnSE09Xv52u2xXGLAdEwAAANE"]
[Tue Apr 07 05:36:10.017089 2026] [:error] [pid 37596:tid 37613] [client 217.138.216.222:34020] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "adQnSqpaAOZHEjRWjP3t9wAAAAc"]
[Tue Apr 07 05:36:10.592464 2026] [:error] [pid 12948:tid 12968] [client 217.138.216.222:34036] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "adQnSsbeSPAN8LvMqsb_6wAAARE"]
[Tue Apr 07 05:36:12.348677 2026] [:error] [pid 12948:tid 12958] [client 217.138.216.222:34046] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "adQnTMbeSPAN8LvMqsb_-QAAAQc"]
[Tue Apr 07 05:36:13.529643 2026] [:error] [pid 37597:tid 37657] [client 217.138.216.222:34058] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "adQnTQ6uAY0QAy-8EEI_eQAAAFc"]
[Tue Apr 07 05:36:14.992868 2026] [:error] [pid 12948:tid 12965] [client 217.138.216.222:57974] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "adQnTsbeSPAN8LvMqsYAEAAAAQ4"]
[Tue Apr 07 05:36:15.570426 2026] [:error] [pid 12948:tid 12972] [client 217.138.216.222:57988] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "adQnT8beSPAN8LvMqsYAFQAAARU"]
[Tue Apr 07 05:36:16.151291 2026] [:error] [pid 12948:tid 12965] [client 217.138.216.222:57992] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "adQnUMbeSPAN8LvMqsYAGgAAAQ4"]
[Tue Apr 07 05:36:19.223484 2026] [:error] [pid 12948:tid 12957] [client 217.138.216.222:58002] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "adQnU8beSPAN8LvMqsYAMgAAAQY"]
[Tue Apr 07 05:36:20.389358 2026] [:error] [pid 37596:tid 37626] [client 217.138.216.222:58016] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "adQnVKpaAOZHEjRWjP3t_wAAABQ"]
[Tue Apr 07 05:36:20.966674 2026] [:error] [pid 12948:tid 12968] [client 217.138.216.222:58030] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "adQnVMbeSPAN8LvMqsYAPwAAARE"]
[Tue Apr 07 05:36:21.845378 2026] [:error] [pid 12948:tid 12956] [client 217.138.216.222:58044] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "adQnVcbeSPAN8LvMqsYARgAAAQU"]
[Tue Apr 07 05:36:22.428517 2026] [:error] [pid 12948:tid 12967] [client 217.138.216.222:58046] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "adQnVsbeSPAN8LvMqsYASwAAARA"]
[Tue Apr 07 05:36:23.603406 2026] [:error] [pid 37597:tid 37650] [client 217.138.216.222:58062] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "adQnVw6uAY0QAy-8EEI_iAAAAFA"]
[Tue Apr 07 05:36:24.496251 2026] [:error] [pid 12948:tid 12952] [client 217.138.216.222:43136] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "adQnWMbeSPAN8LvMqsYAYgAAAQE"]
[Tue Apr 07 05:36:25.082827 2026] [:error] [pid 37719:tid 37745] [client 217.138.216.222:43144] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "adQnWU09Xv52u2xXGLAdMAAAANc"]
[Tue Apr 07 05:36:25.672814 2026] [:error] [pid 37598:tid 37667] [client 217.138.216.222:43150] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "adQnWe9g7q_cV2WhPax0CgAAAIY"]
[Tue Apr 07 05:36:26.842251 2026] [:error] [pid 37596:tid 37624] [client 217.138.216.222:43166] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "adQnWqpaAOZHEjRWjP3uDAAAABI"]
[Tue Apr 07 05:36:28.005871 2026] [:error] [pid 12948:tid 12953] [client 217.138.216.222:43182] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "adQnXMbeSPAN8LvMqsYAdgAAAQI"]
[Tue Apr 07 05:36:28.867984 2026] [:error] [pid 37596:tid 37619] [client 217.138.216.222:43196] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "adQnXKpaAOZHEjRWjP3uEAAAAA0"]
[Tue Apr 07 05:36:29.751785 2026] [:error] [pid 37597:tid 37653] [client 217.138.216.222:43204] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "adQnXQ6uAY0QAy-8EEI_kgAAAFM"]
[Tue Apr 07 05:36:32.077939 2026] [:error] [pid 37596:tid 37626] [client 217.138.216.222:43216] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "adQnYKpaAOZHEjRWjP3uHQAAABQ"]
[Tue Apr 07 05:36:32.653778 2026] [:error] [pid 37597:tid 37642] [client 217.138.216.222:43220] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "adQnYA6uAY0QAy-8EEI_ngAAAEg"]
[Tue Apr 07 05:36:33.816554 2026] [:error] [pid 12948:tid 12958] [client 217.138.216.222:43224] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "adQnYcbeSPAN8LvMqsYAhQAAAQc"]
[Tue Apr 07 05:36:35.570392 2026] [:error] [pid 37719:tid 37740] [client 217.138.216.222:35418] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "adQnY009Xv52u2xXGLAdUQAAANI"]
[Tue Apr 07 05:36:36.741433 2026] [:error] [pid 37598:tid 37685] [client 217.138.216.222:35422] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "adQnZO9g7q_cV2WhPax0EgAAAJg"]
[Tue Apr 07 05:36:37.916411 2026] [:error] [pid 37598:tid 37683] [client 217.138.216.222:35424] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "adQnZe9g7q_cV2WhPax0GAAAAJY"]
[Tue Apr 07 05:36:38.794688 2026] [:error] [pid 12948:tid 12966] [client 217.138.216.222:35436] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "adQnZsbeSPAN8LvMqsYAnAAAAQ8"]
[Tue Apr 07 05:36:39.665712 2026] [:error] [pid 37598:tid 37664] [client 217.138.216.222:35438] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "adQnZ-9g7q_cV2WhPax0GwAAAIM"]
[Tue Apr 07 05:36:41.413795 2026] [:error] [pid 37719:tid 37735] [client 217.138.216.222:35450] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "adQnaU09Xv52u2xXGLAdWQAAAM0"]
[Tue Apr 07 05:36:42.881574 2026] [:error] [pid 37597:tid 37649] [client 217.138.216.222:53892] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "adQnag6uAY0QAy-8EEI_0gAAAE8"]
[Tue Apr 07 05:36:43.463981 2026] [proxy_fcgi:error] [pid 12948:tid 12975] [client 217.138.216.222:35470] AH01071: Got error 'Primary script unknown'
[Tue Apr 07 05:36:43.750250 2026] [:error] [pid 12948:tid 12966] [client 217.138.216.222:35470] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "adQna8beSPAN8LvMqsYApwAAAQ8"]
[Tue Apr 07 05:36:44.327396 2026] [:error] [pid 37597:tid 37642] [client 217.138.216.222:39710] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "adQnbA6uAY0QAy-8EEI_2QAAAEg"]
[Tue Apr 07 05:36:45.491911 2026] [:error] [pid 37719:tid 37743] [client 217.138.216.222:39718] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "adQnbU09Xv52u2xXGLAdZQAAANU"]
[Tue Apr 07 05:36:46.079713 2026] [:error] [pid 37598:tid 37684] [client 217.138.216.222:39726] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "adQnbu9g7q_cV2WhPax0KQAAAJc"]
[Tue Apr 07 05:36:49.719474 2026] [:error] [pid 37719:tid 37744] [client 217.138.216.222:60303] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "adQncU09Xv52u2xXGLAdeQAAANY"]
[Tue Apr 07 05:36:50.300847 2026] [:error] [pid 12948:tid 12968] [client 217.138.216.222:39744] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "adQncsbeSPAN8LvMqsYAvQAAARE"]
[Tue Apr 07 05:36:51.180549 2026] [:error] [pid 37719:tid 37723] [client 217.138.216.222:39750] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/log.php"] [unique_id "adQnc009Xv52u2xXGLAdfAAAAME"]
[Tue Apr 07 05:36:51.760207 2026] [:error] [pid 12948:tid 12971] [client 217.138.216.222:39762] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "adQnc8beSPAN8LvMqsYAwAAAARQ"]
[Tue Apr 07 05:36:52.344093 2026] [:error] [pid 37597:tid 37635] [client 217.138.216.222:39766] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "adQndA6uAY0QAy-8EEI_9AAAAEE"]
[Tue Apr 07 05:36:52.930459 2026] [:error] [pid 12948:tid 12969] [client 217.138.216.222:39774] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/aw.php"] [unique_id "adQndMbeSPAN8LvMqsYAwgAAARI"]
[Tue Apr 07 05:36:54.772804 2026] [:error] [pid 12948:tid 12969] [client 217.138.216.222:39786] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "adQndsbeSPAN8LvMqsYA0QAAARI"]
[Tue Apr 07 05:36:55.354222 2026] [:error] [pid 12948:tid 12962] [client 217.138.216.222:35780] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "adQnd8beSPAN8LvMqsYA1AAAAQs"]
[Tue Apr 07 05:36:56.541156 2026] [:error] [pid 12948:tid 12975] [client 217.138.216.222:35794] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "adQneMbeSPAN8LvMqsYA3wAAARg"]
[Tue Apr 07 05:36:57.134911 2026] [:error] [pid 37598:tid 37678] [client 217.138.216.222:35796] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "adQnee9g7q_cV2WhPax0QgAAAJE"]
[Tue Apr 07 05:36:58.367024 2026] [:error] [pid 37596:tid 37618] [client 217.138.216.222:35808] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "adQneqpaAOZHEjRWjP3uPgAAAAw"]
[Tue Apr 07 05:36:58.952090 2026] [:error] [pid 37597:tid 37638] [client 217.138.216.222:35818] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "adQneg6uAY0QAy-8EEJACwAAAEQ"]
[Tue Apr 07 05:37:01.617411 2026] [:error] [pid 37598:tid 37664] [client 217.138.216.222:35826] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "adQnfe9g7q_cV2WhPax0VwAAAIM"]
[Tue Apr 07 05:37:02.210635 2026] [:error] [pid 12948:tid 12974] [client 217.138.216.222:35830] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "adQnfsbeSPAN8LvMqsYA7QAAARc"]
[Tue Apr 07 05:37:03.387324 2026] [:error] [pid 37598:tid 37677] [client 217.138.216.222:35838] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/file.php"] [unique_id "adQnf-9g7q_cV2WhPax0YgAAAJA"]
[Tue Apr 07 05:37:04.270984 2026] [:error] [pid 12948:tid 12965] [client 217.138.216.222:41882] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "adQngMbeSPAN8LvMqsYA9wAAAQ4"]
[Tue Apr 07 05:37:05.147488 2026] [:error] [pid 37719:tid 37727] [client 217.138.216.222:41898] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/load.php"] [unique_id "adQngU09Xv52u2xXGLAduAAAAMU"]
[Tue Apr 07 05:37:05.730095 2026] [:error] [pid 12948:tid 12955] [client 217.138.216.222:41906] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "adQngcbeSPAN8LvMqsYA-wAAAQQ"]
[Tue Apr 07 05:37:06.321117 2026] [:error] [pid 37597:tid 37640] [client 217.138.216.222:41916] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "adQngg6uAY0QAy-8EEJAKgAAAEY"]
[Tue Apr 07 05:37:07.788802 2026] [:error] [pid 37596:tid 37621] [client 217.138.216.222:41924] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "adQng6paAOZHEjRWjP3uTQAAAA8"]
[Tue Apr 07 05:37:10.384594 2026] [:error] [pid 37596:tid 37610] [client 217.138.216.222:41926] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "adQnhqpaAOZHEjRWjP3uVAAAAAQ"]
[Tue Apr 07 05:37:11.549507 2026] [:error] [pid 37719:tid 37722] [client 217.138.216.222:41928] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "adQnh009Xv52u2xXGLAd4wAAAMA"]
[Tue Apr 07 05:37:12.160877 2026] [:error] [pid 37596:tid 37622] [client 217.138.216.222:41932] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "adQniKpaAOZHEjRWjP3uWgAAABA"]
[Tue Apr 07 05:37:12.742317 2026] [:error] [pid 12948:tid 12968] [client 217.138.216.222:32191] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "adQniMbeSPAN8LvMqsYBFwAAARE"]
[Tue Apr 07 05:37:15.684619 2026] [:error] [pid 12948:tid 12974] [client 217.138.216.222:41946] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "adQni8beSPAN8LvMqsYBKgAAARc"]
[Tue Apr 07 05:37:16.566970 2026] [:error] [pid 12948:tid 12972] [client 217.138.216.222:44592] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "adQnjMbeSPAN8LvMqsYBMQAAARU"]
[Tue Apr 07 05:37:17.757396 2026] [:error] [pid 37719:tid 37742] [client 217.138.216.222:44608] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "adQnjU09Xv52u2xXGLAeBwAAANQ"]
[Tue Apr 07 05:37:18.338632 2026] [:error] [pid 37719:tid 37723] [client 217.138.216.222:44614] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "adQnjk09Xv52u2xXGLAeCQAAAME"]
[Tue Apr 07 05:37:18.920739 2026] [:error] [pid 37597:tid 37635] [client 217.138.216.222:44624] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "adQnjg6uAY0QAy-8EEJARQAAAEE"]
[Tue Apr 07 05:37:20.086245 2026] [:error] [pid 37597:tid 37658] [client 217.138.216.222:44640] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "adQnkA6uAY0QAy-8EEJASgAAAFg"]
[Tue Apr 07 05:37:22.693938 2026] [:error] [pid 12948:tid 12957] [client 217.138.216.222:44644] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ms-pie.php"] [unique_id "adQnksbeSPAN8LvMqsYBVAAAAQY"]
[Tue Apr 07 05:37:24.474882 2026] [:error] [pid 37719:tid 37726] [client 217.138.216.222:44660] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "adQnlE09Xv52u2xXGLAeNQAAAMQ"]
[Tue Apr 07 05:37:25.675242 2026] [:error] [pid 37719:tid 37723] [client 217.138.216.222:37022] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/nav-menu.php"] [unique_id "adQnlU09Xv52u2xXGLAeRQAAAME"]
[Tue Apr 07 05:37:26.256577 2026] [:error] [pid 12948:tid 12956] [client 217.138.216.222:37024] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/user.php"] [unique_id "adQnlsbeSPAN8LvMqsYBXgAAAQU"]
[Tue Apr 07 05:37:30.064020 2026] [:error] [pid 37719:tid 37739] [client 217.138.216.222:37038] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "adQnmk09Xv52u2xXGLAeagAAANE"]
[Tue Apr 07 05:37:30.646691 2026] [:error] [pid 37598:tid 37675] [client 217.138.216.222:37054] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "adQnmu9g7q_cV2WhPax0kAAAAI4"]
[Tue Apr 07 05:37:31.231346 2026] [:error] [pid 37598:tid 37670] [client 217.138.216.222:37070] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "adQnm-9g7q_cV2WhPax0lwAAAIk"]
[Tue Apr 07 05:37:32.108422 2026] [:error] [pid 37597:tid 37637] [client 217.138.216.222:37076] [client 217.138.216.222] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 217.138.216.222, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "adQnnA6uAY0QAy-8EEJAXAAAAEM"]
[Tue Apr 07 05:37:32.702178 2026] [:error] [pid 37597:tid 37645] [client 217.138.216.222:37076] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "adQnnA6uAY0QAy-8EEJAXgAAAEs"]
[Tue Apr 07 05:37:33.286546 2026] [:error] [pid 12948:tid 12963] [client 217.138.216.222:37080] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "adQnncbeSPAN8LvMqsYBcwAAAQw"]
[Tue Apr 07 05:37:33.870208 2026] [:error] [pid 37596:tid 37625] [client 217.138.216.222:37086] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "adQnnapaAOZHEjRWjP3uegAAABM"]
[Tue Apr 07 05:37:36.229863 2026] [:error] [pid 37597:tid 37656] [client 217.138.216.222:59778] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "adQnoA6uAY0QAy-8EEJAbgAAAFY"]
[Tue Apr 07 05:37:40.167171 2026] [:error] [pid 37597:tid 37642] [client 217.138.216.222:59792] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "adQnpA6uAY0QAy-8EEJAgwAAAEg"]
[Tue Apr 07 05:37:41.359944 2026] [:error] [pid 37597:tid 37655] [client 217.138.216.222:59800] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "adQnpQ6uAY0QAy-8EEJAigAAAFU"]
[Tue Apr 07 05:37:45.425879 2026] [:error] [pid 37719:tid 37723] [client 217.138.216.222:59804] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "adQnqU09Xv52u2xXGLAeyAAAAME"]
[Tue Apr 07 05:37:46.006359 2026] [:error] [pid 37596:tid 37606] [client 217.138.216.222:45738] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "adQnqqpaAOZHEjRWjP3uqwAAAAA"]
[Tue Apr 07 05:37:46.590054 2026] [:error] [pid 37598:tid 37670] [client 217.138.216.222:45748] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/mer_gagal.php"] [unique_id "adQnqu9g7q_cV2WhPax0vgAAAIk"]
[Tue Apr 07 05:37:47.167955 2026] [:error] [pid 12948:tid 12954] [client 217.138.216.222:45762] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "adQnq8beSPAN8LvMqsYBuQAAAQM"]
[Tue Apr 07 05:37:48.641657 2026] [:error] [pid 12948:tid 12959] [client 217.138.216.222:45776] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "adQnrMbeSPAN8LvMqsYBvwAAAQg"]
[Tue Apr 07 05:37:49.224421 2026] [:error] [pid 37598:tid 37680] [client 217.138.216.222:45784] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "adQnre9g7q_cV2WhPax0wwAAAJM"]
[Tue Apr 07 05:37:51.288621 2026] [:error] [pid 37598:tid 37667] [client 217.138.216.222:45786] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "adQnr-9g7q_cV2WhPax00QAAAIY"]
[Tue Apr 07 05:37:53.043785 2026] [:error] [pid 37598:tid 37682] [client 217.138.216.222:45800] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "adQnse9g7q_cV2WhPax02gAAAJU"]
[Tue Apr 07 05:37:53.621794 2026] [:error] [pid 37719:tid 37742] [client 217.138.216.222:45804] [client 217.138.216.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "adQnsU09Xv52u2xXGLAe5wAAANQ"]
[Tue Apr 07 05:38:23.143186 2026] [autoindex:error] [pid 37719:tid 37724] [client 217.138.216.222:46112] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Tue Apr 07 06:54:47.670383 2026] [:error] [pid 37597:tid 37635] [client 45.131.195.49:62185] [client 45.131.195.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "adQ5tw6uAY0QAy-8EEJhowAAAEE"]
[Tue Apr 07 10:56:55.547932 2026] [:error] [pid 37719:tid 37730] [client 217.216.72.68:50860] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/"] [unique_id "adRyd009Xv52u2xXGLDvGAAAAMg"]
[Tue Apr 07 10:56:59.608982 2026] [:error] [pid 37719:tid 37734] [client 217.216.72.68:63329] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/"] [unique_id "adRye009Xv52u2xXGLDvLAAAAMw"]
[Tue Apr 07 10:56:59.716759 2026] [:error] [pid 37719:tid 37737] [client 217.216.72.68:64021] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/"] [unique_id "adRye009Xv52u2xXGLDvPgAAAM8"]
[Tue Apr 07 10:57:09.122170 2026] [:error] [pid 37598:tid 37674] [client 217.216.72.68:55819] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "adRyhe9g7q_cV2WhPawTfAAAAI0"]
[Tue Apr 07 10:57:09.240594 2026] [:error] [pid 59490:tid 59515] [client 217.216.72.68:55821] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "adRyhUcw8OFbiUZ7Rx0R9AAAAVc"]
[Tue Apr 07 10:57:22.208204 2026] [:error] [pid 37598:tid 37676] [client 217.216.72.68:55668] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/"] [unique_id "adRyku9g7q_cV2WhPawTswAAAI8"]
[Tue Apr 07 10:57:22.319671 2026] [:error] [pid 37596:tid 37608] [client 217.216.72.68:55458] [client 217.216.72.68] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/readme.html"] [unique_id "adRykqpaAOZHEjRWjP1XWQAAAAI"]
[Tue Apr 07 14:38:01.687632 2026] [:error] [pid 37596:tid 37617] [client 123.231.16.195:48814] [client 123.231.16.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 123.231.16.195, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "adSmSapaAOZHEjRWjP1uiAAAAAs"]
[Tue Apr 07 18:36:25.646479 2026] [:error] [pid 37597:tid 37648] [client 159.89.55.133:47518] [client 159.89.55.133] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adTeKQ6uAY0QAy-8EEIZUwAAAE4"]
[Wed Apr 08 02:45:41.768532 2026] [:error] [pid 4860:tid 5234] [client 45.144.115.4:57388] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "adVQ1Qn6KmY32L3WSeHuHAAAAJM"]
[Wed Apr 08 02:45:43.256892 2026] [:error] [pid 4860:tid 5224] [client 45.144.115.4:34828] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "adVQ1wn6KmY32L3WSeHuKwAAAIk"]
[Wed Apr 08 02:45:45.841606 2026] [:error] [pid 303:tid 321] [client 45.144.115.4:34830] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "adVQ2c9wWR0DHTrNMugpIAAAAU8"]
[Wed Apr 08 02:45:48.994457 2026] [:error] [pid 5246:tid 5260] [client 45.144.115.4:60996] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "adVQ3BLpySxaVC8kLEap_wAAAMo"]
[Wed Apr 08 02:45:51.174064 2026] [:error] [pid 303:tid 317] [client 45.144.115.4:32780] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "adVQ389wWR0DHTrNMugpRgAAAUs"]
[Wed Apr 08 02:45:52.248339 2026] [:error] [pid 303:tid 312] [client 45.144.115.4:32790] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "adVQ4M9wWR0DHTrNMugpVAAAAUY"]
[Wed Apr 08 02:45:52.802873 2026] [:error] [pid 4840:tid 5172] [client 45.144.115.4:32806] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "adVQ4BsUwg2fEe9p9LT0RgAAAAw"]
[Wed Apr 08 02:45:53.331555 2026] [:error] [pid 5337:tid 5373] [client 45.144.115.4:32810] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "adVQ4SboIFdw6tlcN11S1gAAAQ8"]
[Wed Apr 08 02:45:53.944901 2026] [:error] [pid 5337:tid 5359] [client 45.144.115.4:32812] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "adVQ4SboIFdw6tlcN11S2QAAAQE"]
[Wed Apr 08 02:45:54.464853 2026] [:error] [pid 5337:tid 5382] [client 45.144.115.4:32828] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "adVQ4iboIFdw6tlcN11S4wAAARg"]
[Wed Apr 08 02:45:55.281445 2026] [:error] [pid 5337:tid 5367] [client 45.144.115.4:32838] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "adVQ4yboIFdw6tlcN11S-QAAAQk"]
[Wed Apr 08 02:45:56.513326 2026] [:error] [pid 4860:tid 5219] [client 45.144.115.4:58586] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "adVQ5An6KmY32L3WSeHuYwAAAIQ"]
[Wed Apr 08 02:45:57.626607 2026] [:error] [pid 5246:tid 5261] [client 45.144.115.4:58592] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "adVQ5RLpySxaVC8kLEaqIwAAAMs"]
[Wed Apr 08 02:45:58.443821 2026] [:error] [pid 303:tid 330] [client 45.144.115.4:58598] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "adVQ5s9wWR0DHTrNMugpfAAAAVg"]
[Wed Apr 08 02:45:59.251225 2026] [:error] [pid 4860:tid 5239] [client 45.144.115.4:58602] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "adVQ5wn6KmY32L3WSeHuaQAAAJg"]
[Wed Apr 08 02:46:01.466743 2026] [:error] [pid 4860:tid 5224] [client 45.144.115.4:58604] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "adVQ6Qn6KmY32L3WSeHucwAAAIk"]
[Wed Apr 08 02:46:02.373331 2026] [:error] [pid 303:tid 309] [client 45.144.115.4:58616] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "adVQ6s9wWR0DHTrNMugpngAAAUM"]
[Wed Apr 08 02:46:03.483759 2026] [:error] [pid 4860:tid 5231] [client 45.144.115.4:58624] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "adVQ6wn6KmY32L3WSeHudgAAAJA"]
[Wed Apr 08 02:46:04.362175 2026] [:error] [pid 5246:tid 5264] [client 45.144.115.4:58636] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "adVQ7BLpySxaVC8kLEaqWwAAAM4"]
[Wed Apr 08 02:46:06.027150 2026] [:error] [pid 5337:tid 5369] [client 45.144.115.4:58646] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "adVQ7iboIFdw6tlcN11TYAAAAQs"]
[Wed Apr 08 02:46:06.878455 2026] [:error] [pid 5337:tid 5358] [client 45.144.115.4:37954] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "adVQ7iboIFdw6tlcN11TbQAAAQA"]
[Wed Apr 08 02:46:07.718387 2026] [:error] [pid 5337:tid 5364] [client 45.144.115.4:37960] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "adVQ7yboIFdw6tlcN11TdgAAAQY"]
[Wed Apr 08 02:46:08.272575 2026] [:error] [pid 4840:tid 5175] [client 45.144.115.4:37968] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "adVQ8BsUwg2fEe9p9LT0gAAAAA8"]
[Wed Apr 08 02:46:08.800736 2026] [:error] [pid 303:tid 316] [client 45.144.115.4:37976] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "adVQ8M9wWR0DHTrNMugpsQAAAUo"]
[Wed Apr 08 02:46:10.178725 2026] [:error] [pid 303:tid 328] [client 45.144.115.4:37992] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "adVQ8s9wWR0DHTrNMugpxwAAAVY"]
[Wed Apr 08 02:46:10.717819 2026] [:error] [pid 303:tid 319] [client 45.144.115.4:37998] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "adVQ8s9wWR0DHTrNMugpyQAAAU0"]
[Wed Apr 08 02:46:11.268344 2026] [:error] [pid 5246:tid 5259] [client 45.144.115.4:38004] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adVQ8xLpySxaVC8kLEaqigAAAMk"]
[Wed Apr 08 02:46:15.411712 2026] [:error] [pid 5246:tid 5263] [client 45.144.115.4:38018] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/admin.php"] [unique_id "adVQ9xLpySxaVC8kLEaqqwAAAM0"]
[Wed Apr 08 02:46:16.799584 2026] [:error] [pid 4842:tid 5192] [client 45.144.115.4:32786] [client 45.144.115.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.144.115.4, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "adVQ-JdncJIGbBiMOXTqKwAAAEQ"]
[Wed Apr 08 02:46:20.138767 2026] [:error] [pid 4842:tid 5198] [client 45.144.115.4:32786] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "adVQ_JdncJIGbBiMOXTqPgAAAEo"]
[Wed Apr 08 02:46:21.225814 2026] [:error] [pid 5246:tid 5272] [client 45.144.115.4:32788] [client 45.144.115.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.144.115.4, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "adVQ_RLpySxaVC8kLEaq3gAAANY"]
[Wed Apr 08 02:46:21.781193 2026] [:error] [pid 5246:tid 5259] [client 45.144.115.4:32788] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/item.php"] [unique_id "adVQ_RLpySxaVC8kLEaq5wAAAMk"]
[Wed Apr 08 02:46:24.545508 2026] [:error] [pid 4860:tid 5230] [client 45.144.115.4:32796] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "adVRAAn6KmY32L3WSeHuwgAAAI8"]
[Wed Apr 08 02:46:27.322260 2026] [:error] [pid 5337:tid 5362] [client 45.144.115.4:32810] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "adVRAyboIFdw6tlcN11UCgAAAQQ"]
[Wed Apr 08 02:46:28.419737 2026] [:error] [pid 303:tid 317] [client 45.144.115.4:56630] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "adVRBM9wWR0DHTrNMugqJwAAAUs"]
[Wed Apr 08 02:46:29.798872 2026] [:error] [pid 303:tid 315] [client 45.144.115.4:56640] [client 45.144.115.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.144.115.4, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "adVRBc9wWR0DHTrNMugqPwAAAUk"]
[Wed Apr 08 02:46:30.075373 2026] [:error] [pid 303:tid 329] [client 45.144.115.4:56640] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "adVRBs9wWR0DHTrNMugqRQAAAVc"]
[Wed Apr 08 02:46:35.496001 2026] [:error] [pid 5337:tid 5366] [client 45.144.115.4:56642] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "adVRCyboIFdw6tlcN11UaQAAAQg"]
[Wed Apr 08 02:46:36.860985 2026] [:error] [pid 5337:tid 5374] [client 45.144.115.4:46890] [client 45.144.115.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.144.115.4, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "adVRDCboIFdw6tlcN11UgAAAARA"]
[Wed Apr 08 02:46:39.477360 2026] [:error] [pid 5337:tid 5376] [client 45.144.115.4:46890] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "adVRDyboIFdw6tlcN11UoQAAARI"]
[Wed Apr 08 02:46:40.287981 2026] [:error] [pid 4842:tid 5209] [client 45.144.115.4:46906] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/infi.php"] [unique_id "adVREJdncJIGbBiMOXTqiAAAAFU"]
[Wed Apr 08 02:46:41.391170 2026] [:error] [pid 5246:tid 5257] [client 45.144.115.4:46916] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "adVRERLpySxaVC8kLEarNwAAAMc"]
[Wed Apr 08 02:46:42.767627 2026] [:error] [pid 4840:tid 5162] [client 45.144.115.4:46918] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "adVREhsUwg2fEe9p9LT08gAAAAI"]
[Wed Apr 08 02:46:43.311730 2026] [:error] [pid 5246:tid 5268] [client 45.144.115.4:46924] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "adVRExLpySxaVC8kLEarQAAAANI"]
[Wed Apr 08 02:46:45.275997 2026] [:error] [pid 5246:tid 5261] [client 45.144.115.4:46928] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "adVRFRLpySxaVC8kLEarTAAAAMs"]
[Wed Apr 08 02:46:46.104861 2026] [:error] [pid 4860:tid 5235] [client 45.144.115.4:46930] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "adVRFgn6KmY32L3WSeHvDQAAAJQ"]
[Wed Apr 08 02:46:47.476054 2026] [:error] [pid 5337:tid 5358] [client 45.144.115.4:36378] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/edit.php"] [unique_id "adVRFyboIFdw6tlcN11U-gAAAQA"]
[Wed Apr 08 02:46:48.915275 2026] [:error] [pid 303:tid 321] [client 45.144.115.4:36394] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "adVRGM9wWR0DHTrNMugqogAAAU8"]
[Wed Apr 08 02:46:50.013457 2026] [:error] [pid 5337:tid 5373] [client 45.144.115.4:36398] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/click.php"] [unique_id "adVRGiboIFdw6tlcN11VGAAAAQ8"]
[Wed Apr 08 02:46:51.380629 2026] [:error] [pid 4840:tid 5169] [client 45.144.115.4:36402] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "adVRGxsUwg2fEe9p9LT1EQAAAAk"]
[Wed Apr 08 02:46:53.853991 2026] [:error] [pid 303:tid 312] [client 45.144.115.4:36406] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "adVRHc9wWR0DHTrNMugqzAAAAUY"]
[Wed Apr 08 02:46:54.392593 2026] [:error] [pid 5337:tid 5376] [client 45.144.115.4:36408] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "adVRHiboIFdw6tlcN11VNgAAARI"]
[Wed Apr 08 02:46:54.934220 2026] [:error] [pid 4860:tid 5233] [client 45.144.115.4:36420] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "adVRHgn6KmY32L3WSeHvOwAAAJI"]
[Wed Apr 08 02:46:55.466126 2026] [:error] [pid 4842:tid 5192] [client 45.144.115.4:36428] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "adVRH5dncJIGbBiMOXTqrgAAAEQ"]
[Wed Apr 08 02:46:56.290649 2026] [:error] [pid 4840:tid 5174] [client 45.144.115.4:35216] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "adVRIBsUwg2fEe9p9LT1LwAAAA4"]
[Wed Apr 08 02:46:56.833524 2026] [:error] [pid 303:tid 327] [client 45.144.115.4:35230] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "adVRIM9wWR0DHTrNMugq6AAAAVU"]
[Wed Apr 08 02:46:57.921642 2026] [:error] [pid 5337:tid 5377] [client 45.144.115.4:35244] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "adVRISboIFdw6tlcN11VVgAAARM"]
[Wed Apr 08 02:46:58.481686 2026] [:error] [pid 303:tid 326] [client 45.144.115.4:35258] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "adVRIs9wWR0DHTrNMugq_AAAAVQ"]
[Wed Apr 08 02:46:59.068665 2026] [:error] [pid 4842:tid 5211] [client 45.144.115.4:35270] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "adVRI5dncJIGbBiMOXTquAAAAFc"]
[Wed Apr 08 02:46:59.606566 2026] [:error] [pid 303:tid 328] [client 45.144.115.4:35276] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "adVRI89wWR0DHTrNMugrDAAAAVY"]
[Wed Apr 08 02:47:00.428370 2026] [:error] [pid 5337:tid 5377] [client 45.144.115.4:35290] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "adVRJCboIFdw6tlcN11VYgAAARM"]
[Wed Apr 08 02:47:01.536460 2026] [:error] [pid 303:tid 315] [client 45.144.115.4:35300] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "adVRJc9wWR0DHTrNMugrJwAAAUk"]
[Wed Apr 08 02:47:03.275855 2026] [:error] [pid 5246:tid 5267] [client 45.144.115.4:35304] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "adVRJxLpySxaVC8kLEarpQAAANE"]
[Wed Apr 08 02:47:05.828628 2026] [:error] [pid 5337:tid 5376] [client 45.144.115.4:35314] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "adVRKSboIFdw6tlcN11VnwAAARI"]
[Wed Apr 08 02:47:07.241416 2026] [:error] [pid 4840:tid 5177] [client 45.144.115.4:36594] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "adVRKxsUwg2fEe9p9LT1XQAAABE"]
[Wed Apr 08 02:47:07.771879 2026] [:error] [pid 4842:tid 5189] [client 45.144.115.4:36610] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "adVRK5dncJIGbBiMOXTq7AAAAEE"]
[Wed Apr 08 02:47:09.441104 2026] [:error] [pid 5337:tid 5377] [client 45.144.115.4:36618] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "adVRLSboIFdw6tlcN11VwAAAARM"]
[Wed Apr 08 02:47:10.829914 2026] [proxy_fcgi:error] [pid 4840:tid 5179] [client 45.144.115.4:36620] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:47:11.114093 2026] [proxy_fcgi:error] [pid 4840:tid 5166] [client 45.144.115.4:36620] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:47:11.579367 2026] [proxy_fcgi:error] [pid 4840:tid 5181] [client 45.144.115.4:36620] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:47:12.972155 2026] [:error] [pid 4840:tid 5182] [client 45.144.115.4:36620] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "adVRMBsUwg2fEe9p9LT1cAAAABY"]
[Wed Apr 08 02:47:13.519776 2026] [:error] [pid 5337:tid 5372] [client 45.144.115.4:36622] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "adVRMSboIFdw6tlcN11V6QAAAQ4"]
[Wed Apr 08 02:47:15.785329 2026] [:error] [pid 4840:tid 5177] [client 45.144.115.4:36634] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "adVRMxsUwg2fEe9p9LT1hQAAABE"]
[Wed Apr 08 02:47:16.334723 2026] [:error] [pid 5246:tid 5253] [client 45.144.115.4:53736] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "adVRNBLpySxaVC8kLEar4QAAAMM"]
[Wed Apr 08 02:47:16.872169 2026] [:error] [pid 4842:tid 5190] [client 45.144.115.4:53746] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "adVRNJdncJIGbBiMOXTrDgAAAEI"]
[Wed Apr 08 02:47:17.406907 2026] [:error] [pid 4842:tid 5188] [client 45.144.115.4:53750] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "adVRNZdncJIGbBiMOXTrEAAAAEA"]
[Wed Apr 08 02:47:18.229176 2026] [:error] [pid 4842:tid 5204] [client 45.144.115.4:53766] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "adVRNpdncJIGbBiMOXTrHQAAAFA"]
[Wed Apr 08 02:47:18.760846 2026] [:error] [pid 5246:tid 5262] [client 45.144.115.4:53770] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "adVRNhLpySxaVC8kLEar7QAAAMw"]
[Wed Apr 08 02:47:19.302204 2026] [:error] [pid 5246:tid 5264] [client 45.144.115.4:53772] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "adVRNxLpySxaVC8kLEar9AAAAM4"]
[Wed Apr 08 02:47:19.845014 2026] [:error] [pid 5337:tid 5379] [client 45.144.115.4:53784] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "adVRNyboIFdw6tlcN11WFwAAARU"]
[Wed Apr 08 02:47:20.993502 2026] [:error] [pid 5337:tid 5360] [client 45.144.115.4:53792] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "adVROCboIFdw6tlcN11WLgAAAQI"]
[Wed Apr 08 02:47:23.421052 2026] [:error] [pid 4842:tid 5195] [client 45.144.115.4:53802] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "adVRO5dncJIGbBiMOXTrLwAAAEc"]
[Wed Apr 08 02:47:24.551533 2026] [:error] [pid 5337:tid 5359] [client 45.144.115.4:53806] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "adVRPCboIFdw6tlcN11WXAAAAQE"]
[Wed Apr 08 02:47:25.648950 2026] [:error] [pid 4840:tid 5161] [client 45.144.115.4:53816] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "adVRPRsUwg2fEe9p9LT1rwAAAAE"]
[Wed Apr 08 02:47:26.991352 2026] [:error] [pid 5337:tid 5366] [client 45.144.115.4:37642] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "adVRPiboIFdw6tlcN11WuQAAAQg"]
[Wed Apr 08 02:47:28.976231 2026] [:error] [pid 4840:tid 5178] [client 45.144.115.4:37644] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "adVRQBsUwg2fEe9p9LT1xgAAABI"]
[Wed Apr 08 02:47:30.006214 2026] [:error] [pid 303:tid 313] [client 45.144.115.4:37654] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "adVRQs9wWR0DHTrNMugr7gAAAUc"]
[Wed Apr 08 02:47:35.034544 2026] [:error] [pid 303:tid 322] [client 45.144.115.4:37660] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "adVRR89wWR0DHTrNMugsHQAAAVA"]
[Wed Apr 08 02:47:35.573979 2026] [:error] [pid 5337:tid 5370] [client 45.144.115.4:37674] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "adVRRyboIFdw6tlcN11XQAAAAQw"]
[Wed Apr 08 02:47:36.405074 2026] [:error] [pid 4860:tid 5234] [client 45.144.115.4:41260] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "adVRSAn6KmY32L3WSeHv4wAAAJM"]
[Wed Apr 08 02:47:37.491579 2026] [:error] [pid 303:tid 330] [client 45.144.115.4:41276] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "adVRSc9wWR0DHTrNMugsMgAAAVg"]
[Wed Apr 08 02:47:38.088084 2026] [:error] [pid 5337:tid 5365] [client 45.144.115.4:41284] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "adVRSiboIFdw6tlcN11XVAAAAQc"]
[Wed Apr 08 02:47:39.739763 2026] [:error] [pid 303:tid 311] [client 45.144.115.4:41294] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adVRS89wWR0DHTrNMugsRAAAAUU"]
[Wed Apr 08 02:47:40.286739 2026] [:error] [pid 303:tid 328] [client 45.144.115.4:41306] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "adVRTM9wWR0DHTrNMugsSgAAAVY"]
[Wed Apr 08 02:47:42.224465 2026] [:error] [pid 303:tid 316] [client 45.144.115.4:41308] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "adVRTs9wWR0DHTrNMugsYgAAAUo"]
[Wed Apr 08 02:47:43.050020 2026] [proxy_fcgi:error] [pid 5337:tid 5365] [client 45.144.115.4:41320] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:47:43.600249 2026] [:error] [pid 5337:tid 5360] [client 45.144.115.4:41320] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/function.php"] [unique_id "adVRTyboIFdw6tlcN11XnAAAAQI"]
[Wed Apr 08 02:47:44.145580 2026] [:error] [pid 5337:tid 5374] [client 45.144.115.4:41336] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "adVRUCboIFdw6tlcN11XoQAAARA"]
[Wed Apr 08 02:47:45.223066 2026] [:error] [pid 4840:tid 5166] [client 45.144.115.4:41346] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "adVRURsUwg2fEe9p9LT2DgAAAAY"]
[Wed Apr 08 02:47:45.775943 2026] [:error] [pid 5337:tid 5368] [client 45.144.115.4:41352] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "adVRUSboIFdw6tlcN11XrAAAAQo"]
[Wed Apr 08 02:47:48.239306 2026] [:error] [pid 4840:tid 5161] [client 45.144.115.4:59710] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "adVRVBsUwg2fEe9p9LT2KAAAAAE"]
[Wed Apr 08 02:47:48.789677 2026] [:error] [pid 303:tid 319] [client 45.144.115.4:59716] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "adVRVM9wWR0DHTrNMugsbAAAAU0"]
[Wed Apr 08 02:47:50.441335 2026] [:error] [pid 303:tid 312] [client 45.144.115.4:59726] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "adVRVs9wWR0DHTrNMugshgAAAUY"]
[Wed Apr 08 02:47:50.971813 2026] [:error] [pid 4840:tid 5175] [client 45.144.115.4:59734] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "adVRVhsUwg2fEe9p9LT2NAAAAA8"]
[Wed Apr 08 02:47:51.502591 2026] [:error] [pid 5337:tid 5382] [client 45.144.115.4:59742] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "adVRVyboIFdw6tlcN11XyAAAARg"]
[Wed Apr 08 02:47:53.420956 2026] [:error] [pid 5337:tid 5364] [client 45.144.115.4:59744] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "adVRWSboIFdw6tlcN11X7gAAAQY"]
[Wed Apr 08 02:47:54.210626 2026] [:error] [pid 303:tid 321] [client 45.144.115.4:59754] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "adVRWs9wWR0DHTrNMugsngAAAU8"]
[Wed Apr 08 02:47:56.697629 2026] [:error] [pid 4860:tid 5233] [client 45.144.115.4:59770] [client 45.144.115.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.144.115.4, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/js/wp-login.php"] [unique_id "adVRXAn6KmY32L3WSeHwBwAAAJI"]
[Wed Apr 08 02:47:58.349947 2026] [:error] [pid 4860:tid 5216] [client 45.144.115.4:59770] [client 45.144.115.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.144.115.4, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "adVRXgn6KmY32L3WSeHwEQAAAIE"]
[Wed Apr 08 02:48:01.980430 2026] [proxy_fcgi:error] [pid 4860:tid 5226] [client 45.144.115.4:59770] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:48:06.218799 2026] [:error] [pid 4860:tid 5224] [client 45.144.115.4:59770] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "adVRZgn6KmY32L3WSeHwUgAAAIk"]
[Wed Apr 08 02:48:07.595111 2026] [:error] [pid 5337:tid 5363] [client 45.144.115.4:42610] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "adVRZyboIFdw6tlcN11YYAAAAQU"]
[Wed Apr 08 02:48:08.701358 2026] [:error] [pid 5246:tid 5254] [client 45.144.115.4:42624] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "adVRaBLpySxaVC8kLEatBQAAAMQ"]
[Wed Apr 08 02:48:11.704399 2026] [:error] [pid 5337:tid 5358] [client 45.144.115.4:42630] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "adVRayboIFdw6tlcN11YigAAAQA"]
[Wed Apr 08 02:48:12.808964 2026] [:error] [pid 4860:tid 5222] [client 45.144.115.4:42632] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "adVRbAn6KmY32L3WSeHwaAAAAIc"]
[Wed Apr 08 02:48:13.631582 2026] [:error] [pid 303:tid 327] [client 45.144.115.4:42638] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "adVRbc9wWR0DHTrNMugtDwAAAVU"]
[Wed Apr 08 02:48:15.265407 2026] [proxy_fcgi:error] [pid 5337:tid 5366] [client 45.144.115.4:42640] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:48:15.538920 2026] [proxy_fcgi:error] [pid 5337:tid 5375] [client 45.144.115.4:42640] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:48:15.813832 2026] [:error] [pid 5337:tid 5365] [client 45.144.115.4:42640] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "adVRbyboIFdw6tlcN11YsgAAAQc"]
[Wed Apr 08 02:48:16.355847 2026] [:error] [pid 4840:tid 5181] [client 45.144.115.4:42146] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "adVRcBsUwg2fEe9p9LT2kAAAABU"]
[Wed Apr 08 02:48:18.856388 2026] [:error] [pid 4840:tid 5183] [client 45.144.115.4:42150] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "adVRchsUwg2fEe9p9LT2uAAAABc"]
[Wed Apr 08 02:48:19.691917 2026] [:error] [pid 5337:tid 5364] [client 45.144.115.4:42160] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "adVRcyboIFdw6tlcN11Y4gAAAQY"]
[Wed Apr 08 02:48:21.085037 2026] [:error] [pid 4860:tid 5220] [client 45.144.115.4:42166] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "adVRdQn6KmY32L3WSeHwjwAAAIU"]
[Wed Apr 08 02:48:23.620096 2026] [:error] [pid 5337:tid 5362] [client 45.144.115.4:42170] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "adVRdyboIFdw6tlcN11Y-QAAAQQ"]
[Wed Apr 08 02:48:24.175811 2026] [proxy_fcgi:error] [pid 5337:tid 5372] [client 45.144.115.4:42172] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:48:25.007955 2026] [:error] [pid 5337:tid 5360] [client 45.144.115.4:42172] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "adVReSboIFdw6tlcN11ZDQAAAQI"]
[Wed Apr 08 02:48:26.924522 2026] [proxy_fcgi:error] [pid 5337:tid 5381] [client 45.144.115.4:42176] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:48:27.465665 2026] [:error] [pid 5337:tid 5378] [client 45.144.115.4:42176] [client 45.144.115.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.144.115.4, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "adVReyboIFdw6tlcN11ZPQAAARQ"]
[Wed Apr 08 02:48:30.261642 2026] [:error] [pid 5337:tid 5378] [client 45.144.115.4:42176] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "adVRfiboIFdw6tlcN11ZTAAAARQ"]
[Wed Apr 08 02:48:31.062926 2026] [:error] [pid 5246:tid 5273] [client 45.144.115.4:47016] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "adVRfxLpySxaVC8kLEatdQAAANc"]
[Wed Apr 08 02:48:32.716527 2026] [:error] [pid 4860:tid 5237] [client 45.144.115.4:47028] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "adVRgAn6KmY32L3WSeHwvgAAAJY"]
[Wed Apr 08 02:48:34.170486 2026] [:error] [pid 4840:tid 5181] [client 45.144.115.4:47030] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "adVRghsUwg2fEe9p9LT3AAAAABU"]
[Wed Apr 08 02:48:34.712892 2026] [:error] [pid 5337:tid 5375] [client 45.144.115.4:47044] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "adVRgiboIFdw6tlcN11ZZgAAARE"]
[Wed Apr 08 02:48:36.093342 2026] [:error] [pid 4840:tid 5178] [client 45.144.115.4:47048] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "adVRhBsUwg2fEe9p9LT3CwAAABI"]
[Wed Apr 08 02:48:37.198969 2026] [proxy_fcgi:error] [pid 5337:tid 5367] [client 45.144.115.4:44876] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:48:37.472400 2026] [:error] [pid 5337:tid 5371] [client 45.144.115.4:44876] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "adVRhSboIFdw6tlcN11ZegAAAQ0"]
[Wed Apr 08 02:48:38.301649 2026] [:error] [pid 303:tid 314] [client 45.144.115.4:44892] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/db.php"] [unique_id "adVRhs9wWR0DHTrNMugtngAAAUg"]
[Wed Apr 08 02:48:38.843995 2026] [:error] [pid 4860:tid 5233] [client 45.144.115.4:44898] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "adVRhgn6KmY32L3WSeHw3QAAAJI"]
[Wed Apr 08 02:48:39.363379 2026] [:error] [pid 303:tid 319] [client 45.144.115.4:44908] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "adVRh89wWR0DHTrNMugtqwAAAU0"]
[Wed Apr 08 02:48:39.899789 2026] [:error] [pid 5246:tid 5265] [client 45.144.115.4:44922] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "adVRhxLpySxaVC8kLEatoAAAAM8"]
[Wed Apr 08 02:48:40.459992 2026] [:error] [pid 4860:tid 5227] [client 45.144.115.4:44924] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "adVRiAn6KmY32L3WSeHw4AAAAIw"]
[Wed Apr 08 02:48:40.997005 2026] [:error] [pid 4842:tid 5192] [client 45.144.115.4:44930] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "adVRiJdncJIGbBiMOXTr6AAAAEQ"]
[Wed Apr 08 02:48:42.097466 2026] [:error] [pid 5246:tid 5251] [client 45.144.115.4:44932] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "adVRihLpySxaVC8kLEatrwAAAME"]
[Wed Apr 08 02:48:42.628092 2026] [:error] [pid 303:tid 317] [client 45.144.115.4:44940] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "adVRis9wWR0DHTrNMugtygAAAUs"]
[Wed Apr 08 02:48:43.172764 2026] [:error] [pid 4860:tid 5225] [client 45.144.115.4:44950] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "adVRiwn6KmY32L3WSeHw6wAAAIo"]
[Wed Apr 08 02:48:43.724318 2026] [:error] [pid 4842:tid 5196] [client 45.144.115.4:44954] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "adVRi5dncJIGbBiMOXTr_QAAAEg"]
[Wed Apr 08 02:48:44.273489 2026] [:error] [pid 4842:tid 5201] [client 45.144.115.4:44958] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "adVRjJdncJIGbBiMOXTsBQAAAE0"]
[Wed Apr 08 02:48:44.816736 2026] [proxy_fcgi:error] [pid 303:tid 311] [client 45.144.115.4:44960] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:48:45.642984 2026] [:error] [pid 303:tid 316] [client 45.144.115.4:44960] [client 45.144.115.4] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.144.115.4, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "adVRjc9wWR0DHTrNMugt4AAAAUo"]
[Wed Apr 08 02:48:47.040954 2026] [:error] [pid 303:tid 327] [client 45.144.115.4:44960] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "adVRj89wWR0DHTrNMugt6AAAAVU"]
[Wed Apr 08 02:48:53.408182 2026] [:error] [pid 5337:tid 5380] [client 45.144.115.4:57088] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "adVRlSboIFdw6tlcN11aDwAAARY"]
[Wed Apr 08 02:48:53.956759 2026] [:error] [pid 5337:tid 5361] [client 45.144.115.4:57090] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "adVRlSboIFdw6tlcN11aHAAAAQM"]
[Wed Apr 08 02:48:54.497292 2026] [:error] [pid 4842:tid 5201] [client 45.144.115.4:57096] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "adVRlpdncJIGbBiMOXTsFgAAAE0"]
[Wed Apr 08 02:48:56.696385 2026] [:error] [pid 5337:tid 5382] [client 45.144.115.4:57110] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "adVRmCboIFdw6tlcN11aOwAAARg"]
[Wed Apr 08 02:48:57.248618 2026] [:error] [pid 4860:tid 5229] [client 45.144.115.4:47988] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "adVRmQn6KmY32L3WSeHxBwAAAI4"]
[Wed Apr 08 02:48:57.795456 2026] [:error] [pid 4842:tid 5209] [client 45.144.115.4:47998] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "adVRmZdncJIGbBiMOXTsIQAAAFU"]
[Wed Apr 08 02:48:59.415816 2026] [:error] [pid 303:tid 306] [client 45.144.115.4:48010] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "adVRm89wWR0DHTrNMuguGwAAAUA"]
[Wed Apr 08 02:49:00.233642 2026] [:error] [pid 4860:tid 5237] [client 45.144.115.4:48022] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "adVRnAn6KmY32L3WSeHxGAAAAJY"]
[Wed Apr 08 02:49:01.320758 2026] [:error] [pid 4840:tid 5166] [client 45.144.115.4:48032] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "adVRnRsUwg2fEe9p9LT3ZgAAAAY"]
[Wed Apr 08 02:49:05.486359 2026] [:error] [pid 5337:tid 5368] [client 45.144.115.4:48042] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "adVRoSboIFdw6tlcN11ahwAAAQo"]
[Wed Apr 08 02:49:06.820817 2026] [:error] [pid 4840:tid 5165] [client 45.144.115.4:60694] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/about.php"] [unique_id "adVRohsUwg2fEe9p9LT3gAAAAAU"]
[Wed Apr 08 02:49:11.558340 2026] [:error] [pid 5246:tid 5269] [client 45.144.115.4:60702] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "adVRpxLpySxaVC8kLEauPQAAANM"]
[Wed Apr 08 02:49:12.630785 2026] [:error] [pid 303:tid 312] [client 45.144.115.4:60708] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "adVRqM9wWR0DHTrNMuguZAAAAUY"]
[Wed Apr 08 02:49:14.310454 2026] [:error] [pid 5246:tid 5271] [client 45.144.115.4:60718] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "adVRqhLpySxaVC8kLEauUgAAANU"]
[Wed Apr 08 02:49:15.952012 2026] [:error] [pid 5246:tid 5272] [client 45.144.115.4:60734] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "adVRqxLpySxaVC8kLEauZgAAANY"]
[Wed Apr 08 02:49:17.074798 2026] [:error] [pid 5246:tid 5258] [client 45.144.115.4:39638] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "adVRrRLpySxaVC8kLEaucAAAAMg"]
[Wed Apr 08 02:49:17.643294 2026] [:error] [pid 5337:tid 5361] [client 45.144.115.4:39648] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "adVRrSboIFdw6tlcN11a2AAAAQM"]
[Wed Apr 08 02:49:19.692603 2026] [:error] [pid 4860:tid 5223] [client 45.144.115.4:39650] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "adVRrwn6KmY32L3WSeHxZAAAAIg"]
[Wed Apr 08 02:49:21.647945 2026] [:error] [pid 5337:tid 5377] [client 45.144.115.4:39660] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "adVRsSboIFdw6tlcN11a_QAAARM"]
[Wed Apr 08 02:49:23.318493 2026] [:error] [pid 303:tid 323] [client 45.144.115.4:39662] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adVRs89wWR0DHTrNMuguywAAAVE"]
[Wed Apr 08 02:49:23.854933 2026] [:error] [pid 5337:tid 5381] [client 45.144.115.4:39666] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "adVRsyboIFdw6tlcN11bDQAAARc"]
[Wed Apr 08 02:49:24.680207 2026] [:error] [pid 4840:tid 5160] [client 45.144.115.4:39672] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "adVRtBsUwg2fEe9p9LT3tQAAAAA"]
[Wed Apr 08 02:49:25.792732 2026] [:error] [pid 5337:tid 5382] [client 45.144.115.4:39688] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "adVRtSboIFdw6tlcN11bNwAAARg"]
[Wed Apr 08 02:49:26.352623 2026] [:error] [pid 4840:tid 5163] [client 45.144.115.4:53632] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "adVRthsUwg2fEe9p9LT3ugAAAAM"]
[Wed Apr 08 02:49:28.559797 2026] [:error] [pid 4860:tid 5223] [client 45.144.115.4:53636] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "adVRuAn6KmY32L3WSeHxhwAAAIg"]
[Wed Apr 08 02:49:29.669302 2026] [:error] [pid 303:tid 313] [client 45.144.115.4:53640] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "adVRuc9wWR0DHTrNMugu8wAAAUc"]
[Wed Apr 08 02:49:30.196251 2026] [:error] [pid 5337:tid 5382] [client 45.144.115.4:53646] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "adVRuiboIFdw6tlcN11bcQAAARg"]
[Wed Apr 08 02:49:31.287310 2026] [:error] [pid 303:tid 322] [client 45.144.115.4:53660] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "adVRu89wWR0DHTrNMugu_gAAAVA"]
[Wed Apr 08 02:49:32.101897 2026] [:error] [pid 5337:tid 5377] [client 45.144.115.4:53676] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "adVRvCboIFdw6tlcN11bhwAAARM"]
[Wed Apr 08 02:49:34.046369 2026] [:error] [pid 4860:tid 5232] [client 45.144.115.4:53680] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "adVRvgn6KmY32L3WSeHxlwAAAJE"]
[Wed Apr 08 02:49:35.142657 2026] [:error] [pid 4860:tid 5219] [client 45.144.115.4:53684] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "adVRvwn6KmY32L3WSeHxoAAAAIQ"]
[Wed Apr 08 02:49:36.236035 2026] [:error] [pid 5337:tid 5359] [client 45.144.115.4:53700] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "adVRwCboIFdw6tlcN11blwAAAQE"]
[Wed Apr 08 02:49:37.072336 2026] [:error] [pid 303:tid 319] [client 45.144.115.4:54112] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/as.php"] [unique_id "adVRwc9wWR0DHTrNMugvNAAAAU0"]
[Wed Apr 08 02:49:37.979783 2026] [:error] [pid 303:tid 312] [client 45.144.115.4:54120] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "adVRwc9wWR0DHTrNMugvSQAAAUY"]
[Wed Apr 08 02:49:38.516778 2026] [:error] [pid 303:tid 316] [client 45.144.115.4:54128] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/install.php"] [unique_id "adVRws9wWR0DHTrNMugvTgAAAUo"]
[Wed Apr 08 02:49:39.060661 2026] [:error] [pid 303:tid 324] [client 45.144.115.4:54134] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "adVRw89wWR0DHTrNMugvVgAAAVI"]
[Wed Apr 08 02:49:41.218273 2026] [:error] [pid 5337:tid 5364] [client 45.144.115.4:54142] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "adVRxSboIFdw6tlcN11b0AAAAQY"]
[Wed Apr 08 02:49:42.604207 2026] [:error] [pid 4860:tid 5239] [client 45.144.115.4:54154] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "adVRxgn6KmY32L3WSeHxtAAAAJg"]
[Wed Apr 08 02:49:43.682883 2026] [:error] [pid 5246:tid 5255] [client 45.144.115.4:54158] [client 45.144.115.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "adVRxxLpySxaVC8kLEau2wAAAMU"]
[Wed Apr 08 02:49:44.782580 2026] [:error] [pid 4840:tid 5166] [client 45.144.115.60:54174] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "adVRyBsUwg2fEe9p9LT3_gAAAAY"]
[Wed Apr 08 02:49:46.683501 2026] [:error] [pid 4860:tid 5225] [client 45.144.115.60:54190] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "adVRygn6KmY32L3WSeHxxQAAAIo"]
[Wed Apr 08 02:49:47.487526 2026] [:error] [pid 5337:tid 5376] [client 45.144.115.60:35542] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "adVRyyboIFdw6tlcN11cCQAAARI"]
[Wed Apr 08 02:49:48.286221 2026] [:error] [pid 4860:tid 5217] [client 45.144.115.60:35558] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "adVRzAn6KmY32L3WSeHxyAAAAII"]
[Wed Apr 08 02:49:49.388073 2026] [:error] [pid 303:tid 316] [client 45.144.115.60:35564] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "adVRzc9wWR0DHTrNMugvnAAAAUo"]
[Wed Apr 08 02:49:52.631899 2026] [:error] [pid 4860:tid 5238] [client 45.144.115.60:35566] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "adVR0An6KmY32L3WSeHx2wAAAJc"]
[Wed Apr 08 02:49:53.440330 2026] [:error] [pid 4860:tid 5222] [client 45.144.115.60:35576] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "adVR0Qn6KmY32L3WSeHx3AAAAIc"]
[Wed Apr 08 02:49:54.803989 2026] [:error] [pid 303:tid 323] [client 45.144.115.60:35584] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "adVR0s9wWR0DHTrNMugvswAAAVE"]
[Wed Apr 08 02:49:55.365952 2026] [:error] [pid 4860:tid 5235] [client 45.144.115.60:35592] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "adVR0wn6KmY32L3WSeHx3wAAAJQ"]
[Wed Apr 08 02:49:56.511115 2026] [:error] [pid 303:tid 322] [client 45.144.115.60:36818] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "adVR1M9wWR0DHTrNMugvwAAAAVA"]
[Wed Apr 08 02:49:57.056168 2026] [:error] [pid 5246:tid 5261] [client 45.144.115.60:36822] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "adVR1RLpySxaVC8kLEavFwAAAMs"]
[Wed Apr 08 02:49:57.604156 2026] [:error] [pid 303:tid 307] [client 45.144.115.60:36828] [client 45.144.115.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.144.115.60, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "adVR1c9wWR0DHTrNMugvygAAAUE"]
[Wed Apr 08 02:49:57.614307 2026] [proxy_fcgi:error] [pid 303:tid 307] [client 45.144.115.60:36828] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:49:57.885282 2026] [:error] [pid 303:tid 316] [client 45.144.115.60:36828] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "adVR1c9wWR0DHTrNMugvzgAAAUo"]
[Wed Apr 08 02:49:58.994450 2026] [:error] [pid 4840:tid 5182] [client 45.144.115.60:36832] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "adVR1hsUwg2fEe9p9LT4JAAAABY"]
[Wed Apr 08 02:49:59.538219 2026] [:error] [pid 4840:tid 5165] [client 45.144.115.60:36848] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/network.php"] [unique_id "adVR1xsUwg2fEe9p9LT4JQAAAAU"]
[Wed Apr 08 02:50:02.230622 2026] [:error] [pid 4840:tid 5163] [client 45.144.115.60:36856] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "adVR2hsUwg2fEe9p9LT4RAAAAAM"]
[Wed Apr 08 02:50:03.354862 2026] [:error] [pid 4860:tid 5222] [client 45.144.115.60:36870] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "adVR2wn6KmY32L3WSeHx-QAAAIc"]
[Wed Apr 08 02:50:05.025953 2026] [:error] [pid 4840:tid 5182] [client 45.144.115.60:36872] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "adVR3RsUwg2fEe9p9LT4TAAAABY"]
[Wed Apr 08 02:50:05.716299 2026] [:error] [pid 5246:tid 5263] [client 45.144.115.60:36876] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "adVR3RLpySxaVC8kLEavNgAAAM0"]
[Wed Apr 08 02:50:06.288752 2026] [proxy_fcgi:error] [pid 4840:tid 5166] [client 45.144.115.60:35258] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:50:06.663300 2026] [:error] [pid 4840:tid 5161] [client 45.144.115.60:35258] [client 45.144.115.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.144.115.60, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "adVR3hsUwg2fEe9p9LT4WwAAAAE"]
[Wed Apr 08 02:50:07.271534 2026] [:error] [pid 4840:tid 5178] [client 45.144.115.60:35258] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "adVR3xsUwg2fEe9p9LT4ZAAAABI"]
[Wed Apr 08 02:50:08.823657 2026] [:error] [pid 4840:tid 5184] [client 45.144.115.60:35268] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "adVR4BsUwg2fEe9p9LT4bwAAABg"]
[Wed Apr 08 02:50:09.685662 2026] [:error] [pid 5337:tid 5371] [client 45.144.115.60:35274] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "adVR4SboIFdw6tlcN11cjgAAAQ0"]
[Wed Apr 08 02:50:10.267936 2026] [:error] [pid 4840:tid 5183] [client 45.144.115.60:35290] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "adVR4hsUwg2fEe9p9LT4dwAAABc"]
[Wed Apr 08 02:50:11.718884 2026] [:error] [pid 5337:tid 5375] [client 45.144.115.60:35300] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "adVR4yboIFdw6tlcN11cqAAAARE"]
[Wed Apr 08 02:50:13.071867 2026] [:error] [pid 4860:tid 5237] [client 45.144.115.60:35306] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "adVR5Qn6KmY32L3WSeHyGAAAAJY"]
[Wed Apr 08 02:50:14.901920 2026] [:error] [pid 4842:tid 5206] [client 45.144.115.60:35316] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "adVR5pdncJIGbBiMOXTs6AAAAFI"]
[Wed Apr 08 02:50:15.450861 2026] [:error] [pid 303:tid 318] [client 45.144.115.60:35330] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "adVR589wWR0DHTrNMugwKgAAAUw"]
[Wed Apr 08 02:50:16.286518 2026] [:error] [pid 5337:tid 5363] [client 45.144.115.60:53258] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/count.php"] [unique_id "adVR6CboIFdw6tlcN11cywAAAQU"]
[Wed Apr 08 02:50:18.543213 2026] [:error] [pid 4840:tid 5164] [client 45.144.115.60:53260] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "adVR6hsUwg2fEe9p9LT4nAAAAAQ"]
[Wed Apr 08 02:50:19.673966 2026] [:error] [pid 4860:tid 5228] [client 45.144.115.60:53270] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "paramountestate.com.au"] [uri "/images/stories/themes.php"] [unique_id "adVR6wn6KmY32L3WSeHyNgAAAI0"]
[Wed Apr 08 02:50:19.940586 2026] [:error] [pid 4860:tid 5233] [client 45.144.115.60:53270] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "adVR6wn6KmY32L3WSeHyOgAAAJI"]
[Wed Apr 08 02:50:21.020962 2026] [:error] [pid 4842:tid 5193] [client 45.144.115.60:53276] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "adVR7ZdncJIGbBiMOXTtBQAAAEU"]
[Wed Apr 08 02:50:21.559803 2026] [:error] [pid 4840:tid 5161] [client 45.144.115.60:53288] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "adVR7RsUwg2fEe9p9LT4qwAAAAE"]
[Wed Apr 08 02:50:23.756388 2026] [:error] [pid 303:tid 321] [client 45.144.115.60:53292] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "adVR789wWR0DHTrNMugwYgAAAU8"]
[Wed Apr 08 02:50:24.840599 2026] [:error] [pid 5246:tid 5252] [client 45.144.115.60:53296] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "adVR8BLpySxaVC8kLEavjgAAAMI"]
[Wed Apr 08 02:50:25.673164 2026] [:error] [pid 4840:tid 5178] [client 45.144.115.60:53304] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "adVR8RsUwg2fEe9p9LT4xAAAABI"]
[Wed Apr 08 02:50:27.688807 2026] [:error] [pid 4860:tid 5239] [client 45.144.115.60:39426] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "adVR8wn6KmY32L3WSeHyWwAAAJg"]
[Wed Apr 08 02:50:28.217724 2026] [:error] [pid 303:tid 314] [client 45.144.115.60:39442] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/colour.php"] [unique_id "adVR9M9wWR0DHTrNMugwcQAAAUg"]
[Wed Apr 08 02:50:29.060427 2026] [:error] [pid 4840:tid 5183] [client 45.144.115.60:39458] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "adVR9RsUwg2fEe9p9LT44wAAABc"]
[Wed Apr 08 02:50:29.687905 2026] [:error] [pid 5246:tid 5257] [client 45.144.115.60:39470] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "adVR9RLpySxaVC8kLEavpQAAAMc"]
[Wed Apr 08 02:50:30.791907 2026] [:error] [pid 5246:tid 5268] [client 45.144.115.60:39480] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "adVR9hLpySxaVC8kLEavqgAAANI"]
[Wed Apr 08 02:50:31.892581 2026] [:error] [pid 303:tid 306] [client 45.144.115.60:39494] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "adVR989wWR0DHTrNMugwiwAAAUA"]
[Wed Apr 08 02:50:32.436759 2026] [:error] [pid 5337:tid 5363] [client 45.144.115.60:39510] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "adVR-CboIFdw6tlcN11dPgAAAQU"]
[Wed Apr 08 02:50:34.075509 2026] [:error] [pid 5337:tid 5376] [client 45.144.115.60:39526] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "adVR-iboIFdw6tlcN11dVAAAARI"]
[Wed Apr 08 02:50:35.161759 2026] [:error] [pid 5337:tid 5382] [client 45.144.115.60:39536] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "adVR-yboIFdw6tlcN11dWgAAARg"]
[Wed Apr 08 02:50:36.519471 2026] [:error] [pid 303:tid 319] [client 45.144.115.60:39540] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "adVR_M9wWR0DHTrNMugwvwAAAU0"]
[Wed Apr 08 02:50:37.056165 2026] [:error] [pid 5337:tid 5377] [client 45.144.115.60:38882] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "adVR_SboIFdw6tlcN11dbwAAARM"]
[Wed Apr 08 02:50:37.612904 2026] [:error] [pid 4842:tid 5194] [client 45.144.115.60:38894] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "adVR_ZdncJIGbBiMOXTtOgAAAEY"]
[Wed Apr 08 02:50:38.719489 2026] [:error] [pid 4840:tid 5181] [client 45.144.115.60:38902] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "adVR_hsUwg2fEe9p9LT5EQAAABU"]
[Wed Apr 08 02:50:39.860028 2026] [:error] [pid 4840:tid 5175] [client 45.144.115.60:38908] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "adVR_xsUwg2fEe9p9LT5FwAAAA8"]
[Wed Apr 08 02:50:40.415049 2026] [:error] [pid 5337:tid 5364] [client 45.144.115.60:38924] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "adVSACboIFdw6tlcN11djwAAAQY"]
[Wed Apr 08 02:50:41.302999 2026] [:error] [pid 303:tid 321] [client 45.144.115.60:38928] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "adVSAc9wWR0DHTrNMugw0wAAAU8"]
[Wed Apr 08 02:50:41.852175 2026] [:error] [pid 4840:tid 5179] [client 45.144.115.60:38938] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "adVSARsUwg2fEe9p9LT5IgAAABM"]
[Wed Apr 08 02:50:42.988486 2026] [:error] [pid 5246:tid 5273] [client 45.144.115.60:38944] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "adVSAhLpySxaVC8kLEav3QAAANc"]
[Wed Apr 08 02:50:43.804511 2026] [:error] [pid 303:tid 321] [client 45.144.115.60:38956] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "adVSA89wWR0DHTrNMugw4gAAAU8"]
[Wed Apr 08 02:50:44.362732 2026] [:error] [pid 4860:tid 5216] [client 45.144.115.60:38960] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "adVSBAn6KmY32L3WSeHyhwAAAIE"]
[Wed Apr 08 02:50:44.896223 2026] [:error] [pid 4842:tid 5204] [client 45.144.115.60:38962] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "adVSBJdncJIGbBiMOXTtVAAAAFA"]
[Wed Apr 08 02:50:45.996618 2026] [:error] [pid 4842:tid 5191] [client 45.144.115.60:38978] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "adVSBZdncJIGbBiMOXTtWQAAAEM"]
[Wed Apr 08 02:50:47.073747 2026] [:error] [pid 303:tid 325] [client 45.144.115.60:46648] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "adVSB89wWR0DHTrNMugw-wAAAVM"]
[Wed Apr 08 02:50:47.887220 2026] [:error] [pid 5246:tid 5251] [client 45.144.115.60:46660] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "adVSBxLpySxaVC8kLEav8AAAAME"]
[Wed Apr 08 02:50:48.704433 2026] [:error] [pid 5337:tid 5380] [client 45.144.115.60:46662] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "adVSCCboIFdw6tlcN11d3wAAARY"]
[Wed Apr 08 02:50:50.901049 2026] [:error] [pid 5337:tid 5366] [client 45.144.115.60:46678] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "adVSCiboIFdw6tlcN11eAQAAAQg"]
[Wed Apr 08 02:50:51.461330 2026] [:error] [pid 303:tid 324] [client 45.144.115.60:46688] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "adVSC89wWR0DHTrNMugxDQAAAVI"]
[Wed Apr 08 02:50:52.548190 2026] [:error] [pid 5337:tid 5379] [client 45.144.115.60:46694] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "adVSDCboIFdw6tlcN11eDQAAARU"]
[Wed Apr 08 02:50:54.220515 2026] [:error] [pid 5246:tid 5267] [client 45.144.115.60:46710] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "adVSDhLpySxaVC8kLEav_gAAANE"]
[Wed Apr 08 02:50:55.330611 2026] [:error] [pid 5337:tid 5361] [client 45.144.115.60:46716] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "adVSDyboIFdw6tlcN11eGAAAAQM"]
[Wed Apr 08 02:50:56.463126 2026] [:error] [pid 4840:tid 5174] [client 45.144.115.60:44932] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "adVSEBsUwg2fEe9p9LT5RQAAAA4"]
[Wed Apr 08 02:50:57.279670 2026] [:error] [pid 303:tid 312] [client 45.144.115.60:44934] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "adVSEc9wWR0DHTrNMugxGQAAAUY"]
[Wed Apr 08 02:50:58.111688 2026] [:error] [pid 4840:tid 5169] [client 45.144.115.60:44946] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "adVSEhsUwg2fEe9p9LT5SQAAAAk"]
[Wed Apr 08 02:51:01.369146 2026] [:error] [pid 5337:tid 5369] [client 45.144.115.60:44952] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "adVSFSboIFdw6tlcN11edwAAAQs"]
[Wed Apr 08 02:51:02.781706 2026] [:error] [pid 303:tid 323] [client 45.144.115.60:44956] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "adVSFs9wWR0DHTrNMugxLgAAAVE"]
[Wed Apr 08 02:51:03.367272 2026] [proxy_fcgi:error] [pid 4842:tid 5195] [client 45.144.115.60:44960] AH01071: Got error 'Primary script unknown'
[Wed Apr 08 02:51:03.644414 2026] [:error] [pid 4842:tid 5203] [client 45.144.115.60:44960] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "adVSF5dncJIGbBiMOXTtjgAAAE8"]
[Wed Apr 08 02:51:04.210784 2026] [:error] [pid 303:tid 318] [client 45.144.115.60:44964] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "adVSGM9wWR0DHTrNMugxMgAAAUw"]
[Wed Apr 08 02:51:05.339806 2026] [:error] [pid 5246:tid 5262] [client 45.144.115.60:44972] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "adVSGRLpySxaVC8kLEawIgAAAMw"]
[Wed Apr 08 02:51:05.896533 2026] [:error] [pid 5337:tid 5359] [client 45.144.115.60:49340] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "adVSGSboIFdw6tlcN11ekwAAAQE"]
[Wed Apr 08 02:51:08.110614 2026] [:error] [pid 303:tid 316] [client 45.144.115.60:49352] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "adVSHM9wWR0DHTrNMugxVwAAAUo"]
[Wed Apr 08 02:51:08.658249 2026] [:error] [pid 5337:tid 5362] [client 45.144.115.60:49358] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "adVSHCboIFdw6tlcN11erAAAAQQ"]
[Wed Apr 08 02:51:09.471153 2026] [:error] [pid 303:tid 318] [client 45.144.115.60:49368] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/log.php"] [unique_id "adVSHc9wWR0DHTrNMugxZwAAAUw"]
[Wed Apr 08 02:51:10.014603 2026] [:error] [pid 4840:tid 5164] [client 45.144.115.60:49376] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "adVSHhsUwg2fEe9p9LT5eQAAAAQ"]
[Wed Apr 08 02:51:10.550077 2026] [:error] [pid 5337:tid 5362] [client 45.144.115.60:49382] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "adVSHiboIFdw6tlcN11euAAAAQQ"]
[Wed Apr 08 02:51:11.134081 2026] [:error] [pid 303:tid 320] [client 45.144.115.60:49390] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/aw.php"] [unique_id "adVSH89wWR0DHTrNMugxcgAAAU4"]
[Wed Apr 08 02:51:12.786441 2026] [:error] [pid 303:tid 328] [client 45.144.115.60:49396] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "adVSIM9wWR0DHTrNMugxhAAAAVY"]
[Wed Apr 08 02:51:13.344760 2026] [:error] [pid 5337:tid 5368] [client 45.144.115.60:49398] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "adVSISboIFdw6tlcN11eyQAAAQo"]
[Wed Apr 08 02:51:14.444752 2026] [:error] [pid 4860:tid 5229] [client 45.144.115.60:49406] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "adVSIgn6KmY32L3WSeHy1gAAAI4"]
[Wed Apr 08 02:51:14.994501 2026] [:error] [pid 4860:tid 5218] [client 45.144.115.60:49412] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "adVSIgn6KmY32L3WSeHy3AAAAIM"]
[Wed Apr 08 02:51:16.073431 2026] [:error] [pid 5246:tid 5264] [client 45.144.115.60:49426] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "adVSJBLpySxaVC8kLEawTgAAAM4"]
[Wed Apr 08 02:51:16.609081 2026] [:error] [pid 4860:tid 5216] [client 45.144.115.60:58390] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "adVSJAn6KmY32L3WSeHy5gAAAIE"]
[Wed Apr 08 02:51:20.373273 2026] [:error] [pid 4860:tid 5221] [client 45.144.115.60:58394] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "adVSKAn6KmY32L3WSeHy_gAAAIY"]
[Wed Apr 08 02:51:20.910202 2026] [:error] [pid 303:tid 312] [client 45.144.115.60:58410] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "adVSKM9wWR0DHTrNMugxwwAAAUY"]
[Wed Apr 08 02:51:22.011311 2026] [:error] [pid 5246:tid 5272] [client 45.144.115.60:58424] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/file.php"] [unique_id "adVSKhLpySxaVC8kLEawZAAAANY"]
[Wed Apr 08 02:51:22.861477 2026] [:error] [pid 4840:tid 5169] [client 45.144.115.60:58440] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "adVSKhsUwg2fEe9p9LT5rAAAAAk"]
[Wed Apr 08 02:51:23.691364 2026] [:error] [pid 4860:tid 5229] [client 45.144.115.60:58454] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/load.php"] [unique_id "adVSKwn6KmY32L3WSeHzCQAAAI4"]
[Wed Apr 08 02:51:24.234385 2026] [:error] [pid 303:tid 328] [client 45.144.115.60:58470] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "adVSLM9wWR0DHTrNMugxzwAAAVY"]
[Wed Apr 08 02:51:24.793186 2026] [:error] [pid 5337:tid 5362] [client 45.144.115.60:58478] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "adVSLCboIFdw6tlcN11fGgAAAQQ"]
[Wed Apr 08 02:51:26.170066 2026] [:error] [pid 5337:tid 5374] [client 45.144.115.60:58486] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "adVSLiboIFdw6tlcN11fMgAAARA"]
[Wed Apr 08 02:51:26.995373 2026] [:error] [pid 4842:tid 5196] [client 45.144.115.60:45324] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "adVSLpdncJIGbBiMOXTtwgAAAEg"]
[Wed Apr 08 02:51:28.063174 2026] [:error] [pid 4860:tid 5221] [client 45.144.115.60:45334] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "adVSMAn6KmY32L3WSeHzIQAAAIY"]
[Wed Apr 08 02:51:28.603064 2026] [:error] [pid 303:tid 330] [client 45.144.115.60:45346] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "adVSMM9wWR0DHTrNMugx8AAAAVg"]
[Wed Apr 08 02:51:29.148622 2026] [:error] [pid 303:tid 316] [client 45.144.115.60:45348] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "adVSMc9wWR0DHTrNMugx-gAAAUo"]
[Wed Apr 08 02:51:31.892891 2026] [:error] [pid 303:tid 325] [client 45.144.115.60:45350] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "adVSM89wWR0DHTrNMugyEQAAAVM"]
[Wed Apr 08 02:51:32.752942 2026] [:error] [pid 5246:tid 5271] [client 45.144.115.60:45364] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "adVSNBLpySxaVC8kLEawoAAAANU"]
[Wed Apr 08 02:51:34.167778 2026] [:error] [pid 303:tid 313] [client 45.144.115.60:45378] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "adVSNs9wWR0DHTrNMugyHQAAAUc"]
[Wed Apr 08 02:51:34.729940 2026] [:error] [pid 4842:tid 5188] [client 45.144.115.60:45394] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "adVSNpdncJIGbBiMOXTt4AAAAEA"]
[Wed Apr 08 02:51:35.260990 2026] [:error] [pid 5337:tid 5363] [client 45.144.115.60:45400] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "adVSNyboIFdw6tlcN11fZQAAAQU"]
[Wed Apr 08 02:51:36.365744 2026] [:error] [pid 5337:tid 5367] [client 45.144.115.60:45404] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "adVSOCboIFdw6tlcN11fjAAAAQk"]
[Wed Apr 08 02:51:38.832842 2026] [:error] [pid 4840:tid 5172] [client 45.144.115.60:47946] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ms-pie.php"] [unique_id "adVSOhsUwg2fEe9p9LT55QAAAAw"]
[Wed Apr 08 02:51:40.449249 2026] [:error] [pid 303:tid 330] [client 45.144.115.60:47952] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "adVSPM9wWR0DHTrNMugyQwAAAVg"]
[Wed Apr 08 02:51:41.542601 2026] [:error] [pid 4842:tid 5198] [client 45.144.115.60:47966] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/nav-menu.php"] [unique_id "adVSPZdncJIGbBiMOXTuCgAAAEo"]
[Wed Apr 08 02:51:42.125666 2026] [:error] [pid 4860:tid 5233] [client 45.144.115.60:47980] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/user.php"] [unique_id "adVSPgn6KmY32L3WSeHzTAAAAJI"]
[Wed Apr 08 02:51:45.812395 2026] [:error] [pid 5337:tid 5372] [client 45.144.115.60:47996] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "adVSQSboIFdw6tlcN11f5QAAAQ4"]
[Wed Apr 08 02:51:46.350098 2026] [:error] [pid 5337:tid 5361] [client 45.144.115.60:47042] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "adVSQiboIFdw6tlcN11f6AAAAQM"]
[Wed Apr 08 02:51:47.395088 2026] [:error] [pid 5246:tid 5266] [client 45.144.115.60:47050] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "adVSQxLpySxaVC8kLEaw7wAAANA"]
[Wed Apr 08 02:51:48.214539 2026] [:error] [pid 4860:tid 5229] [client 45.144.115.60:47056] [client 45.144.115.60] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.144.115.60, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "adVSRAn6KmY32L3WSeHzYgAAAI4"]
[Wed Apr 08 02:51:48.777866 2026] [:error] [pid 4860:tid 5218] [client 45.144.115.60:47056] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "adVSRAn6KmY32L3WSeHzbgAAAIM"]
[Wed Apr 08 02:51:49.321904 2026] [:error] [pid 303:tid 322] [client 45.144.115.60:47068] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "adVSRc9wWR0DHTrNMugyagAAAVA"]
[Wed Apr 08 02:51:49.860834 2026] [:error] [pid 303:tid 322] [client 45.144.115.60:47082] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "adVSRc9wWR0DHTrNMugycgAAAVA"]
[Wed Apr 08 02:51:52.071758 2026] [:error] [pid 4860:tid 5220] [client 45.144.115.60:47092] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "adVSSAn6KmY32L3WSeHzfwAAAIU"]
[Wed Apr 08 02:51:54.615405 2026] [:error] [pid 5246:tid 5258] [client 45.144.115.60:47096] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "adVSShLpySxaVC8kLEaxGwAAAMg"]
[Wed Apr 08 02:51:57.224089 2026] [:error] [pid 303:tid 323] [client 45.144.115.60:33624] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "adVSTc9wWR0DHTrNMugylwAAAVE"]
[Wed Apr 08 02:52:01.140136 2026] [:error] [pid 303:tid 308] [client 45.144.115.60:33630] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "adVSUc9wWR0DHTrNMugyxQAAAUI"]
[Wed Apr 08 02:52:01.674944 2026] [:error] [pid 4842:tid 5203] [client 45.144.115.60:33638] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "adVSUZdncJIGbBiMOXTuMAAAAE8"]
[Wed Apr 08 02:52:02.225671 2026] [:error] [pid 5337:tid 5382] [client 45.144.115.60:33652] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/mer_gagal.php"] [unique_id "adVSUiboIFdw6tlcN11gKQAAARg"]
[Wed Apr 08 02:52:02.809162 2026] [:error] [pid 4840:tid 5184] [client 45.144.115.60:33668] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "adVSUhsUwg2fEe9p9LT6XgAAABg"]
[Wed Apr 08 02:52:04.187535 2026] [:error] [pid 5246:tid 5256] [client 45.144.115.60:33684] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "adVSVBLpySxaVC8kLEaxSAAAAMY"]
[Wed Apr 08 02:52:04.766382 2026] [:error] [pid 4860:tid 5226] [client 45.144.115.60:33694] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "adVSVAn6KmY32L3WSeHzngAAAIs"]
[Wed Apr 08 02:52:06.749754 2026] [:error] [pid 5337:tid 5374] [client 45.144.115.60:33702] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "adVSViboIFdw6tlcN11gWgAAARA"]
[Wed Apr 08 02:52:08.447732 2026] [:error] [pid 303:tid 318] [client 45.144.115.60:60224] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "adVSWM9wWR0DHTrNMugy8QAAAUw"]
[Wed Apr 08 02:52:09.000718 2026] [:error] [pid 5246:tid 5256] [client 45.144.115.60:60234] [client 45.144.115.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "adVSWBLpySxaVC8kLEaxbQAAAMY"]
[Wed Apr 08 02:52:38.276431 2026] [autoindex:error] [pid 5337:tid 5375] [client 45.144.115.60:60244] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Wed Apr 08 05:16:01.759462 2026] [:error] [pid 16630:tid 16634] [client 104.28.163.34:41627] [client 104.28.163.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "adV0ESjfVAkPG-jgJEqD5AAAAQI"]
[Wed Apr 08 05:16:02.107450 2026] [:error] [pid 47626:tid 47692] [client 104.28.163.34:41648] [client 104.28.163.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "adV0EqjWI8TWtHx2sdb4SAAAAFg"]
[Wed Apr 08 05:16:02.797918 2026] [:error] [pid 47627:tid 47701] [client 104.28.163.34:40351] [client 104.28.163.34] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "adV0EnOljf1Quv_kDjmNqQAAAII"]
[Wed Apr 08 09:25:35.820925 2026] [:error] [pid 47732:tid 47754] [client 103.168.67.159:4902] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "adWuj4m4N5QW9Mh7G128EwAAANQ"]
[Wed Apr 08 09:25:36.537423 2026] [:error] [pid 47732:tid 47736] [client 103.168.67.159:5478] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "adWukIm4N5QW9Mh7G128IAAAAMI"]
[Wed Apr 08 09:25:37.251085 2026] [:error] [pid 49984:tid 49990] [client 103.168.67.159:5966] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "adWukeYY_Bz5lRHcJIE-lgAAAUA"]
[Wed Apr 08 09:25:37.979362 2026] [:error] [pid 47627:tid 47715] [client 103.168.67.159:6516] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "adWukXOljf1Quv_kDjn03QAAAJA"]
[Wed Apr 08 09:25:38.689621 2026] [:error] [pid 544:tid 567] [client 103.168.67.159:6986] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dashboard"] [unique_id "adWukjieLKSoiLVA6YfDKAAAAZI"]
[Wed Apr 08 09:25:39.408388 2026] [:error] [pid 47625:tid 47652] [client 103.168.67.159:7448] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dashboard"] [unique_id "adWukyVuHyNWzZlE8PA3IAAAABI"]
[Wed Apr 08 09:25:40.115343 2026] [:error] [pid 47625:tid 47648] [client 103.168.67.159:7904] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dashboard"] [unique_id "adWulCVuHyNWzZlE8PA3MgAAAA4"]
[Wed Apr 08 09:25:40.826526 2026] [:error] [pid 49984:tid 50006] [client 103.168.67.159:8320] [client 103.168.67.159] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dashboard"] [unique_id "adWulOYY_Bz5lRHcJIE-uAAAAVA"]
[Wed Apr 08 10:26:08.399180 2026] [:error] [pid 544:tid 569] [client 122.161.48.83:7803] [client 122.161.48.83] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.161.48.83, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "adW8wDieLKSoiLVA6YfR9QAAAZQ"]
[Wed Apr 08 12:16:24.217411 2026] [:error] [pid 12386:tid 12421] [client 94.130.8.54:47866] [client 94.130.8.54] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "adXWmBLhhLtqHi2gK7UjsQAAAQU"]
[Thu Apr 09 08:30:32.042033 2026] [:error] [pid 22627:tid 22636] [client 20.63.32.44:65431] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adbzKPr8glsF_jKQpr6LIwAAAQY"]
[Thu Apr 09 08:30:32.458813 2026] [:error] [pid 20537:tid 20611] [client 20.63.32.44:65514] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adbzKMSTjpSeyrxLmN5LAQAAAI0"]
[Thu Apr 09 08:30:32.872287 2026] [:error] [pid 20641:tid 20646] [client 20.63.32.44:65521] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adbzKG3LksBSF-6rlka0JgAAAME"]
[Thu Apr 09 08:30:33.297499 2026] [:error] [pid 20535:tid 20546] [client 20.63.32.44:65432] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adbzKQWiD9hWnEUHWdOHogAAAAI"]
[Thu Apr 09 13:02:07.120610 2026] [:error] [pid 24624:tid 24636] [client 20.63.32.44:60112] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adcyz-4Jn-WvK1ZBTvhg5AAAAMo"]
[Thu Apr 09 13:02:07.531149 2026] [:error] [pid 24927:tid 24947] [client 20.63.32.44:60130] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adcyzzXObuzEuw8mNJtMBwAAARE"]
[Thu Apr 09 13:02:07.946681 2026] [:error] [pid 24517:tid 24584] [client 20.63.32.44:60145] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adcyz3boYEn2ZFM_PS81KgAAAIo"]
[Thu Apr 09 13:02:08.397488 2026] [:error] [pid 24515:tid 24532] [client 20.63.32.44:1554] [client 20.63.32.44] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adcy0K1OMnvM2fMnB1Ms2wAAAA0"]
[Thu Apr 09 15:29:07.165732 2026] [:error] [pid 24516:tid 24570] [client 20.240.63.86:11944] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "addVQ9hW7vSS-UkeWCUDUgAAAFc"]
[Thu Apr 09 15:29:08.138289 2026] [:error] [pid 24515:tid 24534] [client 20.240.63.86:38809] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "addVRK1OMnvM2fMnB1NEKAAAAA8"]
[Thu Apr 09 15:29:09.808390 2026] [:error] [pid 24624:tid 24626] [client 20.240.63.86:11664] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "addVRe4Jn-WvK1ZBTviOmAAAAMA"]
[Thu Apr 09 15:29:10.822961 2026] [:error] [pid 18477:tid 18491] [client 20.240.63.86:35080] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/av.php"] [unique_id "addVRsDe826HlFeoLPIx9gAAAUw"]
[Thu Apr 09 15:29:11.778311 2026] [:error] [pid 18477:tid 18484] [client 20.240.63.86:23636] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "addVR8De826HlFeoLPIx-QAAAUU"]
[Thu Apr 09 15:29:12.962028 2026] [:error] [pid 24927:tid 24934] [client 20.240.63.86:21684] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "addVSDXObuzEuw8mNJuS1QAAAQQ"]
[Thu Apr 09 15:29:14.031976 2026] [:error] [pid 24927:tid 24942] [client 20.240.63.86:23641] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "addVSjXObuzEuw8mNJuS3AAAAQw"]
[Thu Apr 09 15:29:15.874382 2026] [:error] [pid 24517:tid 24590] [client 20.240.63.86:54831] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/bolt.php"] [unique_id "addVS3boYEn2ZFM_PS9aWwAAAJA"]
[Thu Apr 09 15:29:16.828246 2026] [:error] [pid 24517:tid 24585] [client 20.240.63.86:11426] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless4.php"] [unique_id "addVTHboYEn2ZFM_PS9aYAAAAIs"]
[Thu Apr 09 15:29:17.649956 2026] [:error] [pid 24927:tid 24936] [client 20.240.63.86:37327] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless4.php"] [unique_id "addVTTXObuzEuw8mNJuS6wAAAQY"]
[Thu Apr 09 15:29:18.362555 2026] [:error] [pid 24517:tid 24596] [client 20.240.63.86:10881] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless4.php"] [unique_id "addVTnboYEn2ZFM_PS9aZgAAAJY"]
[Thu Apr 09 15:29:19.604867 2026] [:error] [pid 24515:tid 24530] [client 20.240.63.86:35104] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless4.php"] [unique_id "addVT61OMnvM2fMnB1NEUgAAAAs"]
[Thu Apr 09 15:29:20.572315 2026] [:error] [pid 24517:tid 24588] [client 20.240.63.86:50846] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "addVUHboYEn2ZFM_PS9aaQAAAI4"]
[Thu Apr 09 15:29:25.920124 2026] [:error] [pid 24517:tid 24590] [client 20.240.63.86:10746] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "addVVXboYEn2ZFM_PS9afQAAAJA"]
[Thu Apr 09 15:29:26.624774 2026] [:error] [pid 24515:tid 24542] [client 20.240.63.86:50873] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "addVVq1OMnvM2fMnB1NEYgAAABc"]
[Thu Apr 09 15:29:28.658829 2026] [:error] [pid 24516:tid 24563] [client 20.240.63.86:10697] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-act.php"] [unique_id "addVWNhW7vSS-UkeWCUDewAAAFA"]
[Thu Apr 09 15:29:30.983267 2026] [:error] [pid 24517:tid 24576] [client 20.240.63.86:12997] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xqq.php"] [unique_id "addVWnboYEn2ZFM_PS9angAAAII"]
[Thu Apr 09 15:29:32.398106 2026] [:error] [pid 24927:tid 24937] [client 20.240.63.86:21670] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xqq.php"] [unique_id "addVXDXObuzEuw8mNJuS-wAAAQc"]
[Thu Apr 09 15:29:34.009508 2026] [:error] [pid 24517:tid 24579] [client 20.240.63.86:37364] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xqq.php"] [unique_id "addVXnboYEn2ZFM_PS9aqQAAAIU"]
[Thu Apr 09 15:29:35.131570 2026] [:error] [pid 24927:tid 24948] [client 20.240.63.86:14773] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xqq.php"] [unique_id "addVXzXObuzEuw8mNJuTBAAAARI"]
[Thu Apr 09 15:29:36.416567 2026] [:error] [pid 24517:tid 24576] [client 20.240.63.86:10751] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plss3.php"] [unique_id "addVYHboYEn2ZFM_PS9atAAAAII"]
[Thu Apr 09 15:29:37.099696 2026] [:error] [pid 18477:tid 18496] [client 20.240.63.86:16152] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plss3.php"] [unique_id "addVYcDe826HlFeoLPIyIQAAAVE"]
[Thu Apr 09 15:29:38.491319 2026] [:error] [pid 24515:tid 24525] [client 20.240.63.86:14733] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plss3.php"] [unique_id "addVYq1OMnvM2fMnB1NEcgAAAAY"]
[Thu Apr 09 15:29:39.421533 2026] [:error] [pid 24516:tid 24547] [client 20.240.63.86:38310] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plss3.php"] [unique_id "addVY9hW7vSS-UkeWCUDggAAAEA"]
[Thu Apr 09 15:29:40.528422 2026] [:error] [pid 24515:tid 24526] [client 20.240.63.86:5431] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aaa.php"] [unique_id "addVZK1OMnvM2fMnB1NEfgAAAAc"]
[Thu Apr 09 15:29:41.287911 2026] [:error] [pid 24517:tid 24580] [client 20.240.63.86:50837] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aaa.php"] [unique_id "addVZXboYEn2ZFM_PS9auwAAAIY"]
[Thu Apr 09 15:29:42.078397 2026] [:error] [pid 24517:tid 24586] [client 20.240.63.86:5376] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aaa.php"] [unique_id "addVZnboYEn2ZFM_PS9awQAAAIw"]
[Thu Apr 09 15:29:42.881212 2026] [:error] [pid 24517:tid 24582] [client 20.240.63.86:42528] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/aaa.php"] [unique_id "addVZnboYEn2ZFM_PS9axgAAAIg"]
[Thu Apr 09 15:29:43.922992 2026] [:error] [pid 24515:tid 24534] [client 20.240.63.86:26651] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/classwithtostring.php"] [unique_id "addVZ61OMnvM2fMnB1NEgwAAAA8"]
[Thu Apr 09 15:29:46.120285 2026] [:error] [pid 24515:tid 24522] [client 20.240.63.86:26634] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/classwithtostring.php"] [unique_id "addVaq1OMnvM2fMnB1NEhgAAAAM"]
[Thu Apr 09 15:29:47.688893 2026] [:error] [pid 24927:tid 24932] [client 20.240.63.86:13977] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/classwithtostring.php"] [unique_id "addVazXObuzEuw8mNJuTDAAAAQI"]
[Thu Apr 09 15:29:48.827571 2026] [:error] [pid 24927:tid 24941] [client 20.240.63.86:16186] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/classwithtostring.php"] [unique_id "addVbDXObuzEuw8mNJuTEAAAAQs"]
[Thu Apr 09 15:29:49.746543 2026] [:error] [pid 24927:tid 24933] [client 20.240.63.86:5433] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "addVbTXObuzEuw8mNJuTEQAAAQM"]
[Thu Apr 09 15:29:50.614172 2026] [:error] [pid 24517:tid 24590] [client 20.240.63.86:10707] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "addVbnboYEn2ZFM_PS9a2wAAAJA"]
[Thu Apr 09 15:29:51.587423 2026] [:error] [pid 24517:tid 24581] [client 20.240.63.86:33608] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "addVb3boYEn2ZFM_PS9a4wAAAIc"]
[Thu Apr 09 15:29:52.932550 2026] [:error] [pid 18477:tid 18482] [client 20.240.63.86:16191] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "addVcMDe826HlFeoLPIyLAAAAUM"]
[Thu Apr 09 15:29:54.097250 2026] [:error] [pid 18477:tid 18497] [client 20.240.63.86:10717] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "addVcsDe826HlFeoLPIyLwAAAVI"]
[Thu Apr 09 15:29:55.145209 2026] [:error] [pid 18477:tid 18493] [client 20.240.63.86:21752] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "addVc8De826HlFeoLPIyMAAAAU4"]
[Thu Apr 09 15:29:56.205990 2026] [:error] [pid 24927:tid 24930] [client 20.240.63.86:5380] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "addVdDXObuzEuw8mNJuTHwAAAQA"]
[Thu Apr 09 15:29:57.664876 2026] [:error] [pid 24515:tid 24524] [client 20.240.63.86:14743] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "addVda1OMnvM2fMnB1NEpwAAAAU"]
[Thu Apr 09 15:29:59.472865 2026] [:error] [pid 24515:tid 24529] [client 20.240.63.86:26640] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "addVd61OMnvM2fMnB1NEqQAAAAo"]
[Thu Apr 09 15:30:00.187455 2026] [:error] [pid 18477:tid 18498] [client 20.240.63.86:10594] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "addVeMDe826HlFeoLPIyPAAAAVM"]
[Thu Apr 09 15:30:00.908062 2026] [:error] [pid 24927:tid 24944] [client 20.240.63.86:13968] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "addVeDXObuzEuw8mNJuTOAAAAQ4"]
[Thu Apr 09 15:30:05.252735 2026] [:error] [pid 24515:tid 24529] [client 20.240.63.86:41953] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "addVfa1OMnvM2fMnB1NEuQAAAAo"]
[Thu Apr 09 15:30:13.576164 2026] [:error] [pid 24517:tid 24580] [client 20.240.63.86:26661] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "addVhXboYEn2ZFM_PS9bKgAAAIY"]
[Thu Apr 09 15:30:14.767073 2026] [:error] [pid 24927:tid 24941] [client 20.240.63.86:41969] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "addVhjXObuzEuw8mNJuTPQAAAQs"]
[Thu Apr 09 15:30:16.074724 2026] [:error] [pid 24927:tid 24933] [client 20.240.63.86:10591] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "addViDXObuzEuw8mNJuTPwAAAQM"]
[Thu Apr 09 15:30:16.962430 2026] [:error] [pid 24624:tid 24647] [client 20.240.63.86:5397] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "addViO4Jn-WvK1ZBTviO1wAAANU"]
[Thu Apr 09 15:30:17.624989 2026] [:error] [pid 18477:tid 18495] [client 20.240.63.86:13988] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cgi-bin/index.php"] [unique_id "addVicDe826HlFeoLPIyRAAAAVA"]
[Thu Apr 09 15:30:18.303454 2026] [:error] [pid 18477:tid 18487] [client 20.240.63.86:12284] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cgi-bin/index.php"] [unique_id "addVisDe826HlFeoLPIyRQAAAUg"]
[Thu Apr 09 15:30:19.171755 2026] [:error] [pid 18477:tid 18481] [client 20.240.63.86:33619] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cgi-bin/index.php"] [unique_id "addVi8De826HlFeoLPIyRwAAAUI"]
[Thu Apr 09 15:30:19.826867 2026] [:error] [pid 18477:tid 18489] [client 20.240.63.86:35625] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/cgi-bin/index.php"] [unique_id "addVi8De826HlFeoLPIySQAAAUo"]
[Thu Apr 09 15:30:20.451112 2026] [:error] [pid 24516:tid 24554] [client 20.240.63.86:5419] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fff.php"] [unique_id "addVjNhW7vSS-UkeWCUDrAAAAEc"]
[Thu Apr 09 15:30:20.991823 2026] [:error] [pid 24927:tid 24939] [client 20.240.63.86:33624] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fff.php"] [unique_id "addVjDXObuzEuw8mNJuTRQAAAQk"]
[Thu Apr 09 15:30:21.781847 2026] [:error] [pid 18477:tid 18503] [client 20.240.63.86:15403] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fff.php"] [unique_id "addVjcDe826HlFeoLPIyTAAAAVg"]
[Thu Apr 09 15:30:22.448064 2026] [:error] [pid 24624:tid 24628] [client 20.240.63.86:22876] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fff.php"] [unique_id "addVju4Jn-WvK1ZBTviO3AAAAMI"]
[Thu Apr 09 15:30:23.044858 2026] [:error] [pid 24624:tid 24633] [client 20.240.63.86:14239] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/"] [unique_id "addVj-4Jn-WvK1ZBTviO3gAAAMc"]
[Thu Apr 09 15:30:23.607823 2026] [:error] [pid 24624:tid 24634] [client 20.240.63.86:33613] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/"] [unique_id "addVj-4Jn-WvK1ZBTviO4QAAAMg"]
[Thu Apr 09 15:30:24.412033 2026] [:error] [pid 24517:tid 24586] [client 20.240.63.86:41260] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/"] [unique_id "addVkHboYEn2ZFM_PS9bMwAAAIw"]
[Thu Apr 09 15:30:25.252657 2026] [:error] [pid 24624:tid 24637] [client 20.240.63.86:33639] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/"] [unique_id "addVke4Jn-WvK1ZBTviO5wAAAMs"]
[Thu Apr 09 15:30:25.871282 2026] [:error] [pid 24517:tid 24585] [client 20.240.63.86:41957] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/we.php"] [unique_id "addVkXboYEn2ZFM_PS9bOwAAAIs"]
[Thu Apr 09 15:30:26.550861 2026] [:error] [pid 24624:tid 24649] [client 20.240.63.86:20112] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/we.php"] [unique_id "addVku4Jn-WvK1ZBTviO6wAAANc"]
[Thu Apr 09 15:30:27.200394 2026] [:error] [pid 24927:tid 24934] [client 20.240.63.86:41256] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/we.php"] [unique_id "addVkzXObuzEuw8mNJuTSQAAAQQ"]
[Thu Apr 09 15:30:27.760633 2026] [:error] [pid 24517:tid 24579] [client 20.240.63.86:41955] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/we.php"] [unique_id "addVk3boYEn2ZFM_PS9bPwAAAIU"]
[Thu Apr 09 15:30:28.357082 2026] [:error] [pid 24515:tid 24540] [client 20.240.63.86:33600] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alpha.php"] [unique_id "addVlK1OMnvM2fMnB1NE5QAAABU"]
[Thu Apr 09 15:30:29.113674 2026] [:error] [pid 24515:tid 24530] [client 20.240.63.86:15370] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alpha.php"] [unique_id "addVla1OMnvM2fMnB1NE5wAAAAs"]
[Thu Apr 09 15:30:30.390864 2026] [:error] [pid 24517:tid 24594] [client 20.240.63.86:16989] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alpha.php"] [unique_id "addVlnboYEn2ZFM_PS9bRwAAAJQ"]
[Thu Apr 09 15:30:31.378275 2026] [:error] [pid 18477:tid 18493] [client 20.240.63.86:10617] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alpha.php"] [unique_id "addVl8De826HlFeoLPIyUQAAAU4"]
[Thu Apr 09 15:30:32.562144 2026] [:error] [pid 18477:tid 18485] [client 20.240.63.86:16961] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/makeasmtp.php"] [unique_id "addVmMDe826HlFeoLPIyWwAAAUY"]
[Thu Apr 09 15:30:33.715661 2026] [:error] [pid 24517:tid 24595] [client 20.240.63.86:20150] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/makeasmtp.php"] [unique_id "addVmXboYEn2ZFM_PS9bTwAAAJU"]
[Thu Apr 09 15:30:34.715514 2026] [:error] [pid 24517:tid 24586] [client 20.240.63.86:43823] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/makeasmtp.php"] [unique_id "addVmnboYEn2ZFM_PS9bUgAAAIw"]
[Thu Apr 09 15:30:36.155286 2026] [:error] [pid 18477:tid 18484] [client 20.240.63.86:5507] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/makeasmtp.php"] [unique_id "addVnMDe826HlFeoLPIyZQAAAUU"]
[Thu Apr 09 15:30:37.962100 2026] [:error] [pid 24517:tid 24596] [client 20.240.63.86:27256] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-michan.php"] [unique_id "addVnXboYEn2ZFM_PS9bWAAAAJY"]
[Thu Apr 09 15:30:39.063753 2026] [:error] [pid 24516:tid 24571] [client 20.240.63.86:37783] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-michan.php"] [unique_id "addVn9hW7vSS-UkeWCUDsgAAAFg"]
[Thu Apr 09 15:30:39.866532 2026] [:error] [pid 24517:tid 24584] [client 20.240.63.86:15416] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-michan.php"] [unique_id "addVn3boYEn2ZFM_PS9bWgAAAIo"]
[Thu Apr 09 15:30:40.595416 2026] [:error] [pid 18477:tid 18492] [client 20.240.63.86:47805] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-michan.php"] [unique_id "addVoMDe826HlFeoLPIyagAAAU0"]
[Thu Apr 09 15:30:41.416016 2026] [:error] [pid 24516:tid 24556] [client 20.240.63.86:10589] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-the.php"] [unique_id "addVodhW7vSS-UkeWCUDswAAAEk"]
[Thu Apr 09 15:30:42.356135 2026] [:error] [pid 24927:tid 24942] [client 20.240.63.86:43797] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-the.php"] [unique_id "addVojXObuzEuw8mNJuTUAAAAQw"]
[Thu Apr 09 15:30:43.065285 2026] [:error] [pid 24927:tid 24937] [client 20.240.63.86:27202] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-the.php"] [unique_id "addVozXObuzEuw8mNJuTUgAAAQc"]
[Thu Apr 09 15:30:43.684088 2026] [:error] [pid 24624:tid 24630] [client 20.240.63.86:26301] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-the.php"] [unique_id "addVo-4Jn-WvK1ZBTviO-wAAAMQ"]
[Thu Apr 09 15:30:44.357922 2026] [:error] [pid 24515:tid 24543] [client 20.240.63.86:47777] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "addVpK1OMnvM2fMnB1NE9AAAABg"]
[Thu Apr 09 15:30:44.909381 2026] [:error] [pid 18477:tid 18489] [client 20.240.63.86:10381] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "addVpMDe826HlFeoLPIybwAAAUo"]
[Thu Apr 09 15:30:45.529951 2026] [:error] [pid 24624:tid 24638] [client 20.240.63.86:47796] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "addVpe4Jn-WvK1ZBTviO_QAAAMw"]
[Thu Apr 09 15:30:46.086166 2026] [:error] [pid 18477:tid 18481] [client 20.240.63.86:26296] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "addVpsDe826HlFeoLPIycQAAAUI"]
[Thu Apr 09 15:30:46.910551 2026] [:error] [pid 18477:tid 18483] [client 20.240.63.86:46444] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/BDKR28WP.php"] [unique_id "addVpsDe826HlFeoLPIycgAAAUQ"]
[Thu Apr 09 15:30:47.837102 2026] [:error] [pid 24624:tid 24628] [client 20.240.63.86:35599] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/BDKR28WP.php"] [unique_id "addVp-4Jn-WvK1ZBTviO_gAAAMI"]
[Thu Apr 09 15:30:48.759073 2026] [:error] [pid 24927:tid 24954] [client 20.240.63.86:33170] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/BDKR28WP.php"] [unique_id "addVqDXObuzEuw8mNJuTXAAAARg"]
[Thu Apr 09 15:30:49.664456 2026] [:error] [pid 24624:tid 24645] [client 20.240.63.86:31148] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/BDKR28WP.php"] [unique_id "addVqe4Jn-WvK1ZBTviO_wAAANM"]
[Thu Apr 09 15:30:50.391951 2026] [:error] [pid 24515:tid 24537] [client 20.240.63.86:47073] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/"] [unique_id "addVqq1OMnvM2fMnB1NE_AAAABI"]
[Thu Apr 09 15:30:51.217881 2026] [:error] [pid 24515:tid 24520] [client 20.240.63.86:31152] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/"] [unique_id "addVq61OMnvM2fMnB1NE_gAAAAE"]
[Thu Apr 09 15:30:51.864847 2026] [:error] [pid 24517:tid 24582] [client 20.240.63.86:18514] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/"] [unique_id "addVq3boYEn2ZFM_PS9bbAAAAIg"]
[Thu Apr 09 15:30:52.651075 2026] [:error] [pid 24624:tid 24634] [client 20.240.63.86:29576] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/"] [unique_id "addVrO4Jn-WvK1ZBTviPAAAAAMg"]
[Thu Apr 09 15:30:53.268200 2026] [:error] [pid 24515:tid 24519] [client 20.240.63.86:18544] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wen.php"] [unique_id "addVra1OMnvM2fMnB1NFAgAAAAA"]
[Thu Apr 09 15:30:53.979369 2026] [:error] [pid 24927:tid 24942] [client 20.240.63.86:45731] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wen.php"] [unique_id "addVrTXObuzEuw8mNJuTYwAAAQw"]
[Thu Apr 09 15:30:54.553837 2026] [:error] [pid 18477:tid 18492] [client 20.240.63.86:22100] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wen.php"] [unique_id "addVrsDe826HlFeoLPIyeQAAAU0"]
[Thu Apr 09 15:30:57.557070 2026] [:error] [pid 24515:tid 24527] [client 20.240.63.86:29579] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wen.php"] [unique_id "addVsa1OMnvM2fMnB1NFBQAAAAg"]
[Thu Apr 09 15:31:12.357860 2026] [:error] [pid 24517:tid 24585] [client 20.240.63.86:28221] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp.php"] [unique_id "addVwHboYEn2ZFM_PS9bhAAAAIs"]
[Thu Apr 09 15:31:23.317642 2026] [:error] [pid 24517:tid 24590] [client 20.240.63.86:11491] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "addVy3boYEn2ZFM_PS9bsAAAAJA"]
[Thu Apr 09 15:31:24.497947 2026] [:error] [pid 24516:tid 24565] [client 20.240.63.86:24061] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "addVzNhW7vSS-UkeWCUD-gAAAFI"]
[Thu Apr 09 15:31:25.754348 2026] [:error] [pid 24515:tid 24527] [client 20.240.63.86:24018] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "addVza1OMnvM2fMnB1NFYgAAAAg"]
[Thu Apr 09 15:31:26.613916 2026] [:error] [pid 24515:tid 24528] [client 20.240.63.86:11476] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "addVzq1OMnvM2fMnB1NFZQAAAAk"]
[Thu Apr 09 15:31:27.629694 2026] [:error] [pid 24517:tid 24593] [client 20.240.63.86:20573] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fi.php"] [unique_id "addVz3boYEn2ZFM_PS9btwAAAJM"]
[Thu Apr 09 15:31:28.656731 2026] [:error] [pid 24517:tid 24586] [client 20.240.63.86:26735] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fi.php"] [unique_id "addV0HboYEn2ZFM_PS9bugAAAIw"]
[Thu Apr 09 15:31:30.290082 2026] [:error] [pid 24515:tid 24531] [client 20.240.63.86:10357] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fi.php"] [unique_id "addV0q1OMnvM2fMnB1NFbgAAAAw"]
[Thu Apr 09 15:31:31.052828 2026] [:error] [pid 24624:tid 24640] [client 20.240.63.86:18143] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/fi.php"] [unique_id "addV0-4Jn-WvK1ZBTviPFgAAAM4"]
[Thu Apr 09 15:31:31.968790 2026] [:error] [pid 24624:tid 24644] [client 20.240.63.86:45070] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a1.php"] [unique_id "addV0-4Jn-WvK1ZBTviPGAAAANI"]
[Thu Apr 09 15:31:33.273824 2026] [:error] [pid 24517:tid 24598] [client 20.240.63.86:18170] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a1.php"] [unique_id "addV1XboYEn2ZFM_PS9bwwAAAJg"]
[Thu Apr 09 15:31:34.651736 2026] [:error] [pid 24515:tid 24533] [client 20.240.63.86:27195] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a1.php"] [unique_id "addV1q1OMnvM2fMnB1NFewAAAA4"]
[Thu Apr 09 15:31:35.559755 2026] [:error] [pid 24624:tid 24633] [client 20.240.63.86:28588] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a1.php"] [unique_id "addV1-4Jn-WvK1ZBTviPGgAAAMc"]
[Thu Apr 09 15:31:37.232480 2026] [:error] [pid 24927:tid 24952] [client 20.240.63.86:13253] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/update/f35.php"] [unique_id "addV2TXObuzEuw8mNJuTcwAAARY"]
[Thu Apr 09 15:31:38.931275 2026] [:error] [pid 18477:tid 18493] [client 20.240.63.86:36833] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/update/f35.php"] [unique_id "addV2sDe826HlFeoLPIyuQAAAU4"]
[Thu Apr 09 15:31:39.793946 2026] [:error] [pid 18477:tid 18495] [client 20.240.63.86:26734] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/update/f35.php"] [unique_id "addV28De826HlFeoLPIyvAAAAVA"]
[Thu Apr 09 15:31:40.583200 2026] [:error] [pid 24515:tid 24530] [client 20.240.63.86:30176] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/update/f35.php"] [unique_id "addV3K1OMnvM2fMnB1NFiAAAAAs"]
[Thu Apr 09 15:31:41.364021 2026] [:error] [pid 24515:tid 24522] [client 20.240.63.86:10550] [client 20.240.63.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "addV3a1OMnvM2fMnB1NFiQAAAAM"]
[Thu Apr 09 15:31:41.988945 2026] [:error] [pid 24515:tid 24524] [client 20.240.63.86:29579] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "addV3a1OMnvM2fMnB1NFjgAAAAU"]
[Thu Apr 09 15:31:43.033692 2026] [:error] [pid 24624:tid 24641] [client 20.240.63.86:52970] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "addV3-4Jn-WvK1ZBTviPHgAAAM8"]
[Thu Apr 09 15:31:43.855694 2026] [:error] [pid 24517:tid 24574] [client 20.240.63.86:12716] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "addV33boYEn2ZFM_PS9byAAAAIA"]
[Thu Apr 09 15:31:44.815923 2026] [:error] [pid 24515:tid 24528] [client 20.240.63.86:30168] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "addV4K1OMnvM2fMnB1NFlQAAAAk"]
[Thu Apr 09 15:31:47.753475 2026] [:error] [pid 24517:tid 24586] [client 20.240.63.86:52938] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "addV43boYEn2ZFM_PS9b1AAAAIw"]
[Thu Apr 09 15:31:48.977579 2026] [:error] [pid 24515:tid 24535] [client 20.240.63.86:13536] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "addV5K1OMnvM2fMnB1NFmgAAABA"]
[Thu Apr 09 15:31:50.606377 2026] [:error] [pid 24517:tid 24574] [client 20.240.63.86:24996] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "addV5nboYEn2ZFM_PS9b2wAAAIA"]
[Thu Apr 09 15:31:51.341671 2026] [:error] [pid 18477:tid 18481] [client 20.240.63.86:6045] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "addV58De826HlFeoLPIyvwAAAUI"]
[Thu Apr 09 15:31:52.289859 2026] [:error] [pid 18477:tid 18501] [client 20.240.63.86:13562] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "addV6MDe826HlFeoLPIywgAAAVY"]
[Thu Apr 09 15:31:53.217318 2026] [:error] [pid 24516:tid 24562] [client 20.240.63.86:19205] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "addV6dhW7vSS-UkeWCUEBAAAAE8"]
[Thu Apr 09 15:31:54.506580 2026] [:error] [pid 24927:tid 24937] [client 20.240.63.86:11476] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "addV6jXObuzEuw8mNJuTgQAAAQc"]
[Thu Apr 09 15:31:55.547702 2026] [:error] [pid 24516:tid 24554] [client 20.240.63.86:14072] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "addV69hW7vSS-UkeWCUEBgAAAEc"]
[Thu Apr 09 15:31:56.662620 2026] [:error] [pid 18477:tid 18490] [client 20.240.63.86:30594] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/prv8.php"] [unique_id "addV7MDe826HlFeoLPIyxgAAAUs"]
[Thu Apr 09 15:31:58.254957 2026] [:error] [pid 18477:tid 18480] [client 20.240.63.86:30088] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/prv8.php"] [unique_id "addV7sDe826HlFeoLPIyyQAAAUE"]
[Thu Apr 09 15:31:59.893576 2026] [:error] [pid 24927:tid 24938] [client 20.240.63.86:10505] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/prv8.php"] [unique_id "addV7zXObuzEuw8mNJuThwAAAQg"]
[Thu Apr 09 15:32:00.610003 2026] [:error] [pid 24515:tid 24543] [client 20.240.63.86:16223] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/prv8.php"] [unique_id "addV8K1OMnvM2fMnB1NFpQAAABg"]
[Thu Apr 09 15:32:01.256248 2026] [:error] [pid 24515:tid 24533] [client 20.240.63.86:14019] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "addV8a1OMnvM2fMnB1NFqAAAAA4"]
[Thu Apr 09 15:32:01.993403 2026] [:error] [pid 18477:tid 18489] [client 20.240.63.86:50314] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "addV8cDe826HlFeoLPIyzgAAAUo"]
[Thu Apr 09 15:32:04.198940 2026] [:error] [pid 18477:tid 18483] [client 20.240.63.86:33254] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "addV9MDe826HlFeoLPIy0wAAAUQ"]
[Thu Apr 09 15:32:05.235653 2026] [:error] [pid 24517:tid 24581] [client 20.240.63.86:43200] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/k.php"] [unique_id "addV9XboYEn2ZFM_PS9b5QAAAIc"]
[Thu Apr 09 15:32:06.044485 2026] [:error] [pid 24517:tid 24585] [client 20.240.63.86:5965] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dev.php"] [unique_id "addV9nboYEn2ZFM_PS9b5wAAAIs"]
[Thu Apr 09 15:32:06.792906 2026] [:error] [pid 24516:tid 24567] [client 20.240.63.86:5841] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dev.php"] [unique_id "addV9thW7vSS-UkeWCUEEgAAAFQ"]
[Thu Apr 09 15:32:08.706281 2026] [:error] [pid 18477:tid 18481] [client 20.240.63.86:50309] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dev.php"] [unique_id "addV-MDe826HlFeoLPIy4QAAAUI"]
[Thu Apr 09 15:32:09.488008 2026] [:error] [pid 24927:tid 24934] [client 20.240.63.86:14020] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/dev.php"] [unique_id "addV-TXObuzEuw8mNJuTtwAAAQQ"]
[Thu Apr 09 15:32:11.038281 2026] [:error] [pid 24927:tid 24943] [client 20.240.63.86:5130] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bal.php"] [unique_id "addV-zXObuzEuw8mNJuTxwAAAQ0"]
[Thu Apr 09 15:32:11.758270 2026] [:error] [pid 24517:tid 24587] [client 20.240.63.86:19234] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bal.php"] [unique_id "addV-3boYEn2ZFM_PS9b-QAAAI0"]
[Thu Apr 09 15:32:13.227875 2026] [:error] [pid 24516:tid 24547] [client 20.240.63.86:16198] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bal.php"] [unique_id "addV_dhW7vSS-UkeWCUERwAAAEA"]
[Thu Apr 09 15:32:13.963578 2026] [:error] [pid 24927:tid 24941] [client 20.240.63.86:5850] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bal.php"] [unique_id "addV_TXObuzEuw8mNJuTzgAAAQs"]
[Thu Apr 09 15:32:15.297204 2026] [:error] [pid 24927:tid 24940] [client 20.240.63.86:45089] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/in.php"] [unique_id "addV_zXObuzEuw8mNJuT1gAAAQo"]
[Thu Apr 09 15:32:16.174061 2026] [:error] [pid 24927:tid 24949] [client 20.240.63.86:13519] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/in.php"] [unique_id "addWADXObuzEuw8mNJuT2QAAARM"]
[Thu Apr 09 15:32:27.350379 2026] [:error] [pid 24624:tid 24646] [client 20.240.63.86:5161] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bs1.php"] [unique_id "addWC-4Jn-WvK1ZBTviPOAAAANQ"]
[Thu Apr 09 15:32:28.357754 2026] [:error] [pid 24517:tid 24580] [client 20.240.63.86:45086] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bs1.php"] [unique_id "addWDHboYEn2ZFM_PS9cFQAAAIY"]
[Thu Apr 09 15:32:28.971202 2026] [:error] [pid 24517:tid 24574] [client 20.240.63.86:30123] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bs1.php"] [unique_id "addWDHboYEn2ZFM_PS9cFgAAAIA"]
[Thu Apr 09 15:32:29.544957 2026] [:error] [pid 24927:tid 24954] [client 20.240.63.86:5152] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bs1.php"] [unique_id "addWDTXObuzEuw8mNJuUDQAAARg"]
[Thu Apr 09 15:32:30.910171 2026] [:error] [pid 24927:tid 24933] [client 20.240.63.86:14023] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bengi.php"] [unique_id "addWDjXObuzEuw8mNJuUFAAAAQM"]
[Thu Apr 09 15:32:31.646050 2026] [:error] [pid 24515:tid 24535] [client 20.240.63.86:45086] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bengi.php"] [unique_id "addWD61OMnvM2fMnB1NFxgAAABA"]
[Thu Apr 09 15:32:32.354050 2026] [:error] [pid 18477:tid 18487] [client 20.240.63.86:33238] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bengi.php"] [unique_id "addWEMDe826HlFeoLPIzCQAAAUg"]
[Thu Apr 09 15:32:33.126797 2026] [:error] [pid 24624:tid 24636] [client 20.240.63.86:25143] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bengi.php"] [unique_id "addWEe4Jn-WvK1ZBTviPQAAAAMo"]
[Thu Apr 09 15:32:33.712719 2026] [:error] [pid 24624:tid 24627] [client 20.240.63.86:33274] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "addWEe4Jn-WvK1ZBTviPQQAAAME"]
[Thu Apr 09 15:32:34.578342 2026] [:error] [pid 18477:tid 18479] [client 20.240.63.86:28598] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "addWEsDe826HlFeoLPIzDwAAAUA"]
[Thu Apr 09 15:32:35.357636 2026] [:error] [pid 24927:tid 24933] [client 20.240.63.86:45100] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "addWEzXObuzEuw8mNJuUSgAAAQM"]
[Thu Apr 09 15:32:36.291947 2026] [:error] [pid 20837:tid 20842] [client 20.240.63.86:20189] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/as.php"] [unique_id "addWFPSL71FHZkjrGzOrFAAAAYM"]
[Thu Apr 09 15:32:37.225924 2026] [:error] [pid 24515:tid 24538] [client 20.240.63.86:21309] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/axx.php"] [unique_id "addWFa1OMnvM2fMnB1NF6QAAABM"]
[Thu Apr 09 15:32:38.145800 2026] [:error] [pid 24624:tid 24635] [client 20.240.63.86:43900] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/axx.php"] [unique_id "addWFu4Jn-WvK1ZBTviPWwAAAMk"]
[Thu Apr 09 15:32:39.206530 2026] [:error] [pid 24927:tid 24939] [client 20.240.63.86:25045] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/axx.php"] [unique_id "addWFzXObuzEuw8mNJuUVQAAAQk"]
[Thu Apr 09 15:32:40.060171 2026] [:error] [pid 24927:tid 24938] [client 20.240.63.86:25491] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/axx.php"] [unique_id "addWGDXObuzEuw8mNJuUWAAAAQg"]
[Thu Apr 09 15:32:41.194000 2026] [:error] [pid 18477:tid 18489] [client 20.240.63.86:5137] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alfashell.php"] [unique_id "addWGcDe826HlFeoLPIzKwAAAUo"]
[Thu Apr 09 15:32:41.939568 2026] [:error] [pid 24515:tid 24539] [client 20.240.63.86:22415] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alfashell.php"] [unique_id "addWGa1OMnvM2fMnB1NF8QAAABQ"]
[Thu Apr 09 15:32:42.731512 2026] [:error] [pid 24624:tid 24636] [client 20.240.63.86:43869] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alfashell.php"] [unique_id "addWGu4Jn-WvK1ZBTviPXgAAAMo"]
[Thu Apr 09 15:32:43.513884 2026] [:error] [pid 24927:tid 24951] [client 20.240.63.86:13776] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/alfashell.php"] [unique_id "addWGzXObuzEuw8mNJuUXAAAARU"]
[Thu Apr 09 15:32:44.608358 2026] [:error] [pid 24515:tid 24536] [client 20.240.63.86:22420] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gettest.php"] [unique_id "addWHK1OMnvM2fMnB1NF-QAAABE"]
[Thu Apr 09 15:32:45.324832 2026] [:error] [pid 24515:tid 24532] [client 20.240.63.86:25036] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gettest.php"] [unique_id "addWHa1OMnvM2fMnB1NF-wAAAA0"]
[Thu Apr 09 15:32:46.172219 2026] [:error] [pid 24624:tid 24634] [client 20.240.63.86:16961] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gettest.php"] [unique_id "addWHu4Jn-WvK1ZBTviPZQAAAMg"]
[Thu Apr 09 15:32:47.035150 2026] [:error] [pid 24515:tid 24539] [client 20.240.63.86:25481] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gettest.php"] [unique_id "addWH61OMnvM2fMnB1NGAAAAABQ"]
[Thu Apr 09 15:32:48.371630 2026] [:error] [pid 24927:tid 24930] [client 20.240.63.86:31713] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/acp.php"] [unique_id "addWIDXObuzEuw8mNJuUYQAAAQA"]
[Thu Apr 09 15:32:50.304167 2026] [:error] [pid 24927:tid 24944] [client 20.240.63.86:31212] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/acp.php"] [unique_id "addWIjXObuzEuw8mNJuUZAAAAQ4"]
[Thu Apr 09 15:32:51.282940 2026] [:error] [pid 24624:tid 24644] [client 20.240.63.86:13819] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/acp.php"] [unique_id "addWI-4Jn-WvK1ZBTviPagAAANI"]
[Thu Apr 09 15:32:52.034835 2026] [:error] [pid 24624:tid 24632] [client 20.240.63.86:13781] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/acp.php"] [unique_id "addWJO4Jn-WvK1ZBTviPbQAAAMY"]
[Thu Apr 09 15:32:52.799510 2026] [:error] [pid 24624:tid 24649] [client 20.240.63.86:12968] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file48.php"] [unique_id "addWJO4Jn-WvK1ZBTviPcgAAANc"]
[Thu Apr 09 15:32:53.814943 2026] [:error] [pid 20837:tid 20851] [client 20.240.63.86:22836] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file48.php"] [unique_id "addWJfSL71FHZkjrGzOrGQAAAYw"]
[Thu Apr 09 15:32:55.011370 2026] [:error] [pid 24927:tid 24943] [client 20.240.63.86:12532] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file48.php"] [unique_id "addWJzXObuzEuw8mNJuUawAAAQ0"]
[Thu Apr 09 15:32:56.062605 2026] [:error] [pid 24927:tid 24946] [client 20.240.63.86:43886] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file48.php"] [unique_id "addWKDXObuzEuw8mNJuUcgAAARA"]
[Thu Apr 09 15:32:57.401434 2026] [:error] [pid 24624:tid 24637] [client 20.240.63.86:41900] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/g.php"] [unique_id "addWKe4Jn-WvK1ZBTviPeAAAAMs"]
[Thu Apr 09 15:32:58.157420 2026] [:error] [pid 18477:tid 18481] [client 20.240.63.86:21288] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/g.php"] [unique_id "addWKsDe826HlFeoLPIzMQAAAUI"]
[Thu Apr 09 15:32:59.423752 2026] [:error] [pid 24927:tid 24948] [client 20.240.63.86:49651] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/g.php"] [unique_id "addWKzXObuzEuw8mNJuUfQAAARI"]
[Thu Apr 09 15:33:00.248960 2026] [:error] [pid 18477:tid 18501] [client 20.240.63.86:38386] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/g.php"] [unique_id "addWLMDe826HlFeoLPIzNgAAAVY"]
[Thu Apr 09 15:33:01.165011 2026] [:error] [pid 24927:tid 24940] [client 20.240.63.86:27750] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/"] [unique_id "addWLTXObuzEuw8mNJuUhAAAAQo"]
[Thu Apr 09 15:33:01.736642 2026] [:error] [pid 24927:tid 24943] [client 20.240.63.86:22803] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/"] [unique_id "addWLTXObuzEuw8mNJuUhgAAAQ0"]
[Thu Apr 09 15:33:02.946254 2026] [:error] [pid 24516:tid 24571] [client 20.240.63.86:20204] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/"] [unique_id "addWLthW7vSS-UkeWCUEiwAAAFg"]
[Thu Apr 09 15:33:03.731349 2026] [:error] [pid 24624:tid 24626] [client 20.240.63.86:22839] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/"] [unique_id "addWL-4Jn-WvK1ZBTviPhAAAAMA"]
[Thu Apr 09 15:33:04.487646 2026] [:error] [pid 24624:tid 24645] [client 20.240.63.86:12948] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/simple.php"] [unique_id "addWMO4Jn-WvK1ZBTviPiAAAANM"]
[Thu Apr 09 15:33:05.210638 2026] [:error] [pid 24517:tid 24596] [client 20.240.63.86:20184] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/simple.php"] [unique_id "addWMXboYEn2ZFM_PS9cRwAAAJY"]
[Thu Apr 09 15:33:06.592835 2026] [:error] [pid 24515:tid 24521] [client 20.240.63.86:10999] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/simple.php"] [unique_id "addWMq1OMnvM2fMnB1NGGgAAAAI"]
[Thu Apr 09 15:33:07.799203 2026] [:error] [pid 24927:tid 24933] [client 20.240.63.86:21267] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/simple.php"] [unique_id "addWMzXObuzEuw8mNJuUjAAAAQM"]
[Thu Apr 09 15:33:08.945957 2026] [:error] [pid 20837:tid 20839] [client 20.240.63.86:31729] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ew.php"] [unique_id "addWNPSL71FHZkjrGzOrIQAAAYA"]
[Thu Apr 09 15:33:10.031619 2026] [:error] [pid 24515:tid 24534] [client 20.240.63.86:10972] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ew.php"] [unique_id "addWNq1OMnvM2fMnB1NGIAAAAA8"]
[Thu Apr 09 15:33:11.395124 2026] [:error] [pid 24927:tid 24950] [client 20.240.63.86:41332] [client 20.240.63.86] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ew.php"] [unique_id "addWNzXObuzEuw8mNJuUkwAAARQ"]
[Thu Apr 09 19:57:13.145846 2026] [:error] [pid 63331:tid 63348] [client 148.251.149.95:50239] [client 148.251.149.95] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "113.182.86.13_84fc7e2a4aa81bd9f8127a411d54ca45ad18ea7d"): Internal error (specific information not available) [hostname "paramountestate.com.au"] [uri "/"] [unique_id "adeUFybKfIYuVjWbE4VLHAAAAc8"]
[Thu Apr 09 22:54:43.571335 2026] [:error] [pid 24624:tid 24649] [client 72.146.3.136:47587] [client 72.146.3.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Ipv6.php"] [unique_id "ade9s-4Jn-WvK1ZBTvj3PAAAANc"]
[Thu Apr 09 22:55:00.534342 2026] [:error] [pid 24515:tid 24543] [client 72.146.3.136:3914] [client 72.146.3.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ade9xK1OMnvM2fMnB1Py2QAAABg"]
[Thu Apr 09 22:55:02.692860 2026] [:error] [pid 24515:tid 24530] [client 72.146.3.136:31825] [client 72.146.3.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "ade9xq1OMnvM2fMnB1Py4QAAAAs"]
[Thu Apr 09 23:29:22.583120 2026] [:error] [pid 24516:tid 24571] [client 20.203.172.210:34448] [client 20.203.172.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "adfF0thW7vSS-UkeWCVDYQAAAFg"]
[Fri Apr 10 21:04:43.727316 2026] [:error] [pid 3934:tid 3959] [client 223.233.86.160:3865] [client 223.233.86.160] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 223.233.86.160, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "adj1a4a41m-BS8mg82fiYgAAANQ"]
[Fri Apr 10 23:57:11.269148 2026] [:error] [pid 13189:tid 13205] [client 158.158.53.142:3969] [client 158.158.53.142] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "adkd15AxiJKPums3eBAeogAAAE0"]
[Sat Apr 11 02:10:32.986429 2026] [:error] [pid 21568:tid 21577] [client 135.116.194.58:54929] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "adk9GIiz5v_ljZxkpR_TQgAAAQU"]
[Sat Apr 11 02:10:34.512282 2026] [:error] [pid 21570:tid 21685] [client 135.116.194.58:54871] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "adk9GjKs5t9xRSNL6cnPFwAAAEw"]
[Sat Apr 11 02:10:35.034943 2026] [:error] [pid 55451:tid 55471] [client 135.116.194.58:54874] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "adk9G3ApxuyB7yCS5RkWkAAAANI"]
[Sat Apr 11 02:10:35.563566 2026] [:error] [pid 21569:tid 21678] [client 135.116.194.58:54955] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xsas.php"] [unique_id "adk9G3AvQTgvXJ6vHoqhsAAAAJY"]
[Sat Apr 11 02:10:36.094521 2026] [:error] [pid 21568:tid 21573] [client 135.116.194.58:54929] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp/jp.php"] [unique_id "adk9HIiz5v_ljZxkpR_TSgAAAQE"]
[Sat Apr 11 02:10:37.641306 2026] [:error] [pid 21568:tid 21585] [client 135.116.194.58:54913] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp/jp.php"] [unique_id "adk9HYiz5v_ljZxkpR_TTQAAAQ0"]
[Sat Apr 11 02:10:38.159535 2026] [:error] [pid 21569:tid 21680] [client 135.116.194.58:54919] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp/jp.php"] [unique_id "adk9HnAvQTgvXJ6vHoqhuwAAAJc"]
[Sat Apr 11 02:10:38.694870 2026] [:error] [pid 21569:tid 21649] [client 135.116.194.58:54855] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp/jp.php"] [unique_id "adk9HnAvQTgvXJ6vHoqhvwAAAIQ"]
[Sat Apr 11 02:10:39.237157 2026] [:error] [pid 21568:tid 21574] [client 135.116.194.58:54922] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/8573.php"] [unique_id "adk9H4iz5v_ljZxkpR_TUwAAAQI"]
[Sat Apr 11 02:10:39.767840 2026] [:error] [pid 21568:tid 21572] [client 135.116.194.58:54963] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/8573.php"] [unique_id "adk9H4iz5v_ljZxkpR_TVAAAAQA"]
[Sat Apr 11 02:10:40.302699 2026] [:error] [pid 55451:tid 55477] [client 135.116.194.58:54854] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/8573.php"] [unique_id "adk9IHApxuyB7yCS5RkWoAAAANg"]
[Sat Apr 11 02:10:40.832567 2026] [:error] [pid 21568:tid 21591] [client 135.116.194.58:10196] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/8573.php"] [unique_id "adk9IIiz5v_ljZxkpR_TWAAAARM"]
[Sat Apr 11 02:10:41.351107 2026] [:error] [pid 21568:tid 21587] [client 135.116.194.58:54872] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp5.php"] [unique_id "adk9IYiz5v_ljZxkpR_TWgAAAQ8"]
[Sat Apr 11 02:10:41.889590 2026] [:error] [pid 21706:tid 21710] [client 135.116.194.58:54849] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp5.php"] [unique_id "adk9ISGQ1M5d8fQSsLGyjgAAAAI"]
[Sat Apr 11 02:10:42.418806 2026] [:error] [pid 21570:tid 21696] [client 135.116.194.58:54952] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp5.php"] [unique_id "adk9IjKs5t9xRSNL6cnPJgAAAFY"]
[Sat Apr 11 02:10:42.964397 2026] [:error] [pid 21570:tid 21663] [client 135.116.194.58:54918] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp5.php"] [unique_id "adk9IjKs5t9xRSNL6cnPKQAAAEE"]
[Sat Apr 11 02:10:44.094209 2026] [:error] [pid 55451:tid 55462] [client 135.116.194.58:54972] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "adk9JHApxuyB7yCS5RkWqAAAAMk"]
[Sat Apr 11 02:10:44.613681 2026] [:error] [pid 21706:tid 21708] [client 135.116.194.58:54959] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "adk9JCGQ1M5d8fQSsLGylwAAAAA"]
[Sat Apr 11 02:10:45.148786 2026] [:error] [pid 55451:tid 55471] [client 135.116.194.58:10178] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "adk9JXApxuyB7yCS5RkWrAAAANI"]
[Sat Apr 11 02:10:46.300613 2026] [:error] [pid 21706:tid 21715] [client 135.116.194.58:54975] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp9.php"] [unique_id "adk9JiGQ1M5d8fQSsLGyogAAAAc"]
[Sat Apr 11 02:10:46.833598 2026] [:error] [pid 21569:tid 21649] [client 135.116.194.58:54970] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "adk9JnAvQTgvXJ6vHoqhxgAAAIQ"]
[Sat Apr 11 02:10:47.377834 2026] [:error] [pid 21570:tid 21694] [client 135.116.194.58:54850] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "adk9JzKs5t9xRSNL6cnPOAAAAFQ"]
[Sat Apr 11 02:10:48.492929 2026] [:error] [pid 55451:tid 55471] [client 135.116.194.58:54966] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "adk9KHApxuyB7yCS5RkWtgAAANI"]
[Sat Apr 11 02:10:50.193351 2026] [:error] [pid 21706:tid 21713] [client 135.116.194.58:54860] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws88.php"] [unique_id "adk9KiGQ1M5d8fQSsLGyqgAAAAU"]
[Sat Apr 11 02:10:50.714356 2026] [:error] [pid 21568:tid 21591] [client 135.116.194.58:54877] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "adk9Koiz5v_ljZxkpR_TawAAARM"]
[Sat Apr 11 02:10:51.279180 2026] [:error] [pid 21570:tid 21663] [client 135.116.194.58:54856] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "adk9KzKs5t9xRSNL6cnPRAAAAEE"]
[Sat Apr 11 02:10:51.818973 2026] [:error] [pid 21570:tid 21661] [client 135.116.194.58:54949] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "adk9KzKs5t9xRSNL6cnPRwAAAEA"]
[Sat Apr 11 02:10:52.368823 2026] [:error] [pid 21570:tid 21691] [client 135.116.194.58:10232] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/motu.php"] [unique_id "adk9LDKs5t9xRSNL6cnPSwAAAFE"]
[Sat Apr 11 02:10:52.911046 2026] [:error] [pid 21706:tid 21728] [client 135.116.194.58:54942] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adk9LCGQ1M5d8fQSsLGyrAAAABQ"]
[Sat Apr 11 02:10:54.022182 2026] [:error] [pid 21706:tid 21708] [client 135.116.194.58:54953] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adk9LiGQ1M5d8fQSsLGyrwAAAAA"]
[Sat Apr 11 02:10:54.546311 2026] [:error] [pid 21570:tid 21670] [client 135.116.194.58:54876] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adk9LjKs5t9xRSNL6cnPUAAAAEQ"]
[Sat Apr 11 02:10:55.086547 2026] [:error] [pid 21569:tid 21646] [client 135.116.194.58:54868] [client 135.116.194.58] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ibcqocdtu3eovdx2hwj7Cdefault.php"] [unique_id "adk9L3AvQTgvXJ6vHoqh4AAAAIE"]
[Sat Apr 11 02:38:17.761901 2026] [:error] [pid 21568:tid 21590] [client 51.103.82.36:44095] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adlDmYiz5v_ljZxkpR_ibgAAARI"]
[Sat Apr 11 02:38:18.656157 2026] [:error] [pid 21706:tid 21714] [client 51.103.82.36:61494] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adlDmiGQ1M5d8fQSsLHPfwAAAAY"]
[Sat Apr 11 02:38:20.775831 2026] [:error] [pid 21570:tid 21697] [client 51.103.82.36:3073] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adlDnDKs5t9xRSNL6cncYgAAAFc"]
[Sat Apr 11 02:38:24.036133 2026] [:error] [pid 21568:tid 21595] [client 51.103.82.36:3204] [client 51.103.82.36] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adlDoIiz5v_ljZxkpR_idAAAARc"]
[Sat Apr 11 03:19:21.226471 2026] [:error] [pid 21569:tid 21676] [client 64.227.25.211:52532] [client 64.227.25.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adlNOXAvQTgvXJ6vHorAAwAAAJU"]
[Sat Apr 11 03:19:23.938942 2026] [:error] [pid 21570:tid 21685] [client 64.227.25.211:33906] [client 64.227.25.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adlNOzKs5t9xRSNL6cnzJgAAAEw"]
[Sat Apr 11 09:04:15.694774 2026] [:error] [pid 13633:tid 13649] [client 216.73.216.32:6659] [client 216.73.216.32] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||paramountestate.com.au|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/robots.txt"] [unique_id "admeD2aKDA-4b93MwJx83AAAAQw"]
[Sat Apr 11 09:42:43.908549 2026] [:error] [pid 34911:tid 34915] [client 157.15.40.61:60062] [client 157.15.40.61] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/media/system/js/core.js"] [unique_id "admnEw4Dca235WG8VGLH0AAAAAI"]
[Sat Apr 11 12:21:55.252864 2026] [:error] [pid 2187:tid 2226] [client 103.216.221.80:29063] [client 103.216.221.80] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.216.221.80, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "adnMYw4J29_qQi0FkjhrOAAAAAA"]
[Sat Apr 11 13:41:52.351854 2026] [:error] [pid 11067:tid 11074] [client 126.209.19.172:50497] [client 126.209.19.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 126.209.19.172, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "adnfIMW3w7N67R04YCJ9oAAAAEU"]
[Sat Apr 11 14:11:37.325830 2026] [:error] [pid 2187:tid 2243] [client 157.15.40.61:56178] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/style.php"] [unique_id "adnmGQ4J29_qQi0FkjiICAAAAA8"]
[Sat Apr 11 14:11:37.586200 2026] [:error] [pid 2297:tid 2313] [client 157.15.40.61:56281] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/style.php"] [unique_id "adnmGbXJS-Jji11jZk3ZBgAAAQw"]
[Sat Apr 11 14:11:37.915601 2026] [:error] [pid 11067:tid 11093] [client 157.15.40.61:56389] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/style.php"] [unique_id "adnmGcW3w7N67R04YCKQsgAAAFg"]
[Sat Apr 11 14:11:38.204713 2026] [:error] [pid 2297:tid 2324] [client 157.15.40.61:56515] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/style.php"] [unique_id "adnmGrXJS-Jji11jZk3ZOwAAARc"]
[Sat Apr 11 14:11:38.473397 2026] [:error] [pid 2186:tid 2212] [client 157.15.40.61:56570] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style.php"] [unique_id "adnmGsibnOEEvcO8wPL9awAAAJU"]
[Sat Apr 11 14:11:39.819319 2026] [:error] [pid 2187:tid 2227] [client 157.15.40.61:56791] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/chosen.php"] [unique_id "adnmGw4J29_qQi0FkjiIRwAAAAE"]
[Sat Apr 11 14:11:42.503223 2026] [:error] [pid 11067:tid 11090] [client 157.15.40.61:56846] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/file.php"] [unique_id "adnmHsW3w7N67R04YCKRpwAAAFU"]
[Sat Apr 11 14:11:43.780373 2026] [:error] [pid 2297:tid 2321] [client 157.15.40.61:57345] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/flower.php"] [unique_id "adnmH7XJS-Jji11jZk3aDwAAARQ"]
[Sat Apr 11 14:11:46.288124 2026] [:error] [pid 2297:tid 2322] [client 157.15.40.61:57576] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "adnmIrXJS-Jji11jZk3aegAAARU"]
[Sat Apr 11 14:11:46.940584 2026] [:error] [pid 2297:tid 2325] [client 157.15.40.61:58060] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/bless.php"] [unique_id "adnmIrXJS-Jji11jZk3angAAARg"]
[Sat Apr 11 14:11:47.205018 2026] [:error] [pid 2297:tid 2313] [client 157.15.40.61:58106] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/class-t.api.php"] [unique_id "adnmI7XJS-Jji11jZk3apAAAAQw"]
[Sat Apr 11 14:11:49.490169 2026] [:error] [pid 11067:tid 11078] [client 157.15.40.61:58285] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/blurbs.php"] [unique_id "adnmJcW3w7N67R04YCKSuQAAAEk"]
[Sat Apr 11 14:11:52.501275 2026] [:error] [pid 2297:tid 2312] [client 157.15.40.61:58638] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/akcc.php"] [unique_id "adnmKLXJS-Jji11jZk3bogAAAQs"]
[Sat Apr 11 14:11:53.144189 2026] [:error] [pid 11067:tid 11093] [client 157.15.40.61:59282] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "adnmKcW3w7N67R04YCKTfAAAAFg"]
[Sat Apr 11 14:11:55.949184 2026] [:error] [pid 11067:tid 11074] [client 157.15.40.61:59341] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/shelp.php"] [unique_id "adnmK8W3w7N67R04YCKUlAAAAEU"]
[Sat Apr 11 14:11:57.393283 2026] [:error] [pid 11067:tid 11083] [client 157.15.40.61:60161] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/cord.php"] [unique_id "adnmLcW3w7N67R04YCKVLwAAAE4"]
[Sat Apr 11 14:11:57.645685 2026] [:error] [pid 2186:tid 2220] [client 157.15.40.61:60235] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/dex.php"] [unique_id "adnmLcibnOEEvcO8wPL-6wAAAJg"]
[Sat Apr 11 14:11:57.906974 2026] [:error] [pid 2187:tid 2226] [client 157.15.40.61:60315] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adnmLQ4J29_qQi0FkjiJmgAAAAA"]
[Sat Apr 11 14:11:59.367066 2026] [:error] [pid 11067:tid 11077] [client 157.15.40.61:60718] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/file2.php"] [unique_id "adnmL8W3w7N67R04YCKV_wAAAEg"]
[Sat Apr 11 14:12:00.563059 2026] [:error] [pid 2186:tid 2220] [client 157.15.40.61:60951] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/zwso.php"] [unique_id "adnmMMibnOEEvcO8wPL_KgAAAJg"]
[Sat Apr 11 14:12:02.521508 2026] [:error] [pid 11067:tid 11089] [client 157.15.40.61:61304] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/zwso.php"] [unique_id "adnmMsW3w7N67R04YCKWpwAAAFQ"]
[Sat Apr 11 14:12:04.410557 2026] [:error] [pid 2188:tid 2261] [client 157.15.40.61:62466] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_mna.php"] [unique_id "adnmNIDhDA-Xtn2nRScMNwAAAMU"]
[Sat Apr 11 14:12:06.246067 2026] [:error] [pid 11067:tid 11080] [client 157.15.40.61:49369] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/bolt.php"] [unique_id "adnmNsW3w7N67R04YCKXCAAAAEs"]
[Sat Apr 11 14:12:08.729050 2026] [:error] [pid 2186:tid 2192] [client 157.15.40.61:50067] [client 157.15.40.61] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/shlo.php"] [unique_id "adnmOMibnOEEvcO8wPL_egAAAII"]
[Sat Apr 11 23:05:01.670993 2026] [:error] [pid 42220:tid 42271] [client 90.175.168.82:50757] [client 90.175.168.82] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 90.175.168.82, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "adpjHUz5c3Cs6a8B5QuXVgAAANQ"]
[Sat Apr 11 23:14:10.617714 2026] [:error] [pid 52608:tid 52626] [client 104.28.163.39:39582] [client 104.28.163.39] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "adplQiY5wH-BLt5QEKhusQAAAQ8"]
[Sun Apr 12 00:49:11.462674 2026] [:error] [pid 44700:tid 44768] [client 209.35.88.123:16053] [client 209.35.88.123] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 209.35.88.123, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "adp7h2ryPgh_uW4QPClQ5AAAANg"]
[Sun Apr 12 02:05:21.277713 2026] [:error] [pid 45064:tid 45114] [client 209.38.77.153:51849] [client 209.38.77.153] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/admin-ajax.php"] [unique_id "adqNYZcHBvLyJ6EUhUoJ7QAAAVU"]
[Sun Apr 12 04:38:04.206145 2026] [:error] [pid 25327:tid 25353] [client 20.220.11.224:35833] [client 20.220.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adqxLC6h2tZEVJo9JFI3ngAAABE"]
[Sun Apr 12 04:38:05.156873 2026] [:error] [pid 25327:tid 25357] [client 20.220.11.224:35817] [client 20.220.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adqxLS6h2tZEVJo9JFI3nwAAABU"]
[Sun Apr 12 04:38:06.064848 2026] [:error] [pid 25328:tid 25403] [client 20.220.11.224:35809] [client 20.220.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adqxLsxUaQZxT-e0YsC-8AAAAFY"]
[Sun Apr 12 04:38:07.330637 2026] [:error] [pid 26599:tid 26612] [client 20.220.11.224:35819] [client 20.220.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adqxL3G89LXoQbk_rwAliAAAAUo"]
[Sun Apr 12 07:41:18.623641 2026] [:error] [pid 60280:tid 60301] [client 20.220.11.224:33671] [client 20.220.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrcHnBlLnDOYuIykkgOSwAAAdM"]
[Sun Apr 12 07:41:19.854148 2026] [:error] [pid 26599:tid 26612] [client 20.220.11.224:33782] [client 20.220.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrcH3G89LXoQbk_rwBfgQAAAUo"]
[Sun Apr 12 07:41:20.861092 2026] [:error] [pid 25328:tid 25369] [client 20.220.11.224:33749] [client 20.220.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrcIMxUaQZxT-e0YsARsQAAAEU"]
[Sun Apr 12 07:41:21.298169 2026] [:error] [pid 26599:tid 26607] [client 20.220.11.224:33665] [client 20.220.11.224] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "adrcIXG89LXoQbk_rwBfhgAAAUU"]
[Sun Apr 12 11:54:26.495764 2026] [:error] [pid 60280:tid 60302] [client 158.158.49.99:31796] [client 158.158.49.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/Ipv6.php"] [unique_id "adsXcnBlLnDOYuIykkiYXwAAAdQ"]
[Sun Apr 12 11:54:43.104098 2026] [:error] [pid 60280:tid 60296] [client 158.158.49.99:31291] [client 158.158.49.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adsXg3BlLnDOYuIykkiYmgAAAc4"]
[Sun Apr 12 11:54:46.236730 2026] [:error] [pid 25328:tid 25396] [client 158.158.49.99:20104] [client 158.158.49.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.paramountestate.com.au"] [uri "/tiny.php"] [unique_id "adsXhsxUaQZxT-e0YsB58gAAAFM"]
[Sun Apr 12 11:54:53.775707 2026] [:error] [pid 25328:tid 25385] [client 158.158.49.99:1369] [client 158.158.49.99] ModSecurity: collections_remove_stale: Failed deleting collection (name "ip", key "192.42.116.99_641794bdbbf5023ca53a4d98ba88a698d33e0799"): Internal error (specific information not available) [hostname "www.paramountestate.com.au"] [uri "/awh.php"] [unique_id "adsXjMxUaQZxT-e0YsB6CAAAAE4"]
[Sun Apr 12 13:16:48.968148 2026] [:error] [pid 25437:tid 25447] [client 20.215.187.9:64139] [client 20.215.187.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Ipv6.php"] [unique_id "adsqwHf97wYZje1ep_PZngAAAMg"]
[Sun Apr 12 13:17:04.917094 2026] [:error] [pid 25327:tid 25348] [client 20.215.187.9:55714] [client 20.215.187.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "adsq0C6h2tZEVJo9JFKdSQAAAAw"]
[Sun Apr 12 13:17:07.231144 2026] [:error] [pid 25328:tid 25398] [client 20.215.187.9:51917] [client 20.215.187.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "adsq08xUaQZxT-e0YsCZXQAAAFQ"]
[Sun Apr 12 15:51:27.092885 2026] [:error] [pid 25437:tid 25451] [client 120.29.79.222:63839] [client 120.29.79.222] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.29.79.222, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "adtO_3f97wYZje1ep_MEZwAAAMw"]
[Mon Apr 13 02:08:31.173916 2026] [:error] [pid 54671:tid 54683] [client 159.89.53.247:44002] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "advfn2yJMmaONUqF0tCC4QAAAQg"]
[Mon Apr 13 02:08:32.125440 2026] [:error] [pid 54671:tid 54699] [client 159.89.53.247:54042] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "advfoGyJMmaONUqF0tCC6gAAARg"]
[Mon Apr 13 02:21:36.618443 2026] [:error] [pid 32010:tid 32020] [client 159.89.53.247:39090] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "advisA0nq-t9pXyV1fypkAAAAMg"]
[Mon Apr 13 02:21:38.780634 2026] [:error] [pid 54671:tid 54690] [client 159.89.53.247:58678] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "advismyJMmaONUqF0tCMegAAAQ8"]
[Mon Apr 13 04:32:55.815179 2026] [:error] [pid 33941:tid 33951] [client 159.89.53.247:59372] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adwBd2_NKERAxgG-rYMgFQAAAAE"]
[Mon Apr 13 04:32:59.187536 2026] [:error] [pid 33941:tid 33957] [client 159.89.53.247:48508] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adwBe2_NKERAxgG-rYMgKwAAAAc"]
[Mon Apr 13 04:34:12.649969 2026] [:error] [pid 33943:tid 34029] [client 159.89.53.247:35758] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adwBxKyoXuZjocnxM5FC8QAAAJc"]
[Mon Apr 13 04:34:14.750355 2026] [:error] [pid 33941:tid 33971] [client 159.89.53.247:46888] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adwBxm_NKERAxgG-rYMhNQAAABQ"]
[Mon Apr 13 06:16:21.041120 2026] [:error] [pid 11325:tid 11342] [client 159.89.53.247:45462] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adwZteCGj3EEJtCwa0OhLgAAAQ8"]
[Mon Apr 13 06:16:23.188438 2026] [:error] [pid 33943:tid 34017] [client 159.89.53.247:35206] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adwZt6yoXuZjocnxM5F2PgAAAIs"]
[Mon Apr 13 08:01:50.255599 2026] [:error] [pid 63406:tid 63431] [client 179.57.56.12:53760] [client 179.57.56.12] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.57.56.12, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "adwybrHZEIkQ0Zmgp5r0hwAAANQ"]
[Mon Apr 13 17:00:35.154351 2026] [:error] [pid 7228:tid 7232] [client 159.89.53.247:50148] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adywswEnn1dQrOSHHNVVVAAAAQI"]
[Mon Apr 13 17:00:38.530082 2026] [:error] [pid 7228:tid 7251] [client 159.89.53.247:54116] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "adywtgEnn1dQrOSHHNVVWQAAARU"]
[Mon Apr 13 20:40:08.695681 2026] [:error] [pid 57183:tid 57201] [client 103.77.107.178:60797] [client 103.77.107.178] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "adzkKDDO3t8R5NaxzYQ75gAAAVA"]
[Mon Apr 13 23:07:39.793897 2026] [:error] [pid 63311:tid 63388] [client 20.240.142.13:1356] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/no18.php"] [unique_id "ad0Gu6HjrGN1MqBCVFkqHAAAAJE"]
[Mon Apr 13 23:07:40.754015 2026] [:error] [pid 57183:tid 57196] [client 20.240.142.13:1186] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/no18.php"] [unique_id "ad0GvDDO3t8R5NaxzYSN3gAAAUs"]
[Mon Apr 13 23:07:42.522373 2026] [:error] [pid 57183:tid 57203] [client 20.240.142.13:11611] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/no18.php"] [unique_id "ad0GvjDO3t8R5NaxzYSN4wAAAVI"]
[Mon Apr 13 23:07:43.820186 2026] [:error] [pid 63406:tid 63417] [client 20.240.142.13:43531] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/no18.php"] [unique_id "ad0Gv7HZEIkQ0Zmgp5oXVgAAAMY"]
[Mon Apr 13 23:07:45.224097 2026] [:error] [pid 63309:tid 63322] [client 20.240.142.13:11637] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/blqjs.php"] [unique_id "ad0GwUpIKZ10weXpf0VDIAAAAAk"]
[Mon Apr 13 23:07:46.899418 2026] [:error] [pid 57183:tid 57196] [client 20.240.142.13:46880] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/blqjs.php"] [unique_id "ad0GwjDO3t8R5NaxzYSN6wAAAUs"]
[Mon Apr 13 23:07:48.488639 2026] [:error] [pid 7228:tid 7230] [client 20.240.142.13:24788] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/blqjs.php"] [unique_id "ad0GxAEnn1dQrOSHHNXG0AAAAQA"]
[Mon Apr 13 23:07:49.326282 2026] [:error] [pid 9314:tid 9339] [client 20.240.142.13:46907] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/blqjs.php"] [unique_id "ad0GxW_r4W8fX2GWyGRYSgAAAZc"]
[Mon Apr 13 23:07:49.976694 2026] [:error] [pid 9314:tid 9331] [client 20.240.142.13:1498] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sk25_1.php"] [unique_id "ad0GxW_r4W8fX2GWyGRYTQAAAY8"]
[Mon Apr 13 23:07:50.585101 2026] [:error] [pid 63311:tid 63387] [client 20.240.142.13:26064] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sk25_1.php"] [unique_id "ad0GxqHjrGN1MqBCVFkqJwAAAJA"]
[Mon Apr 13 23:07:51.734473 2026] [:error] [pid 9314:tid 9325] [client 20.240.142.13:45578] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sk25_1.php"] [unique_id "ad0Gx2_r4W8fX2GWyGRYTwAAAYk"]
[Mon Apr 13 23:07:52.305030 2026] [:error] [pid 63311:tid 63384] [client 20.240.142.13:37751] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sk25_1.php"] [unique_id "ad0GyKHjrGN1MqBCVFkqMAAAAI0"]
[Mon Apr 13 23:07:52.918117 2026] [:error] [pid 7228:tid 7244] [client 20.240.142.13:37759] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fetch.php"] [unique_id "ad0GyAEnn1dQrOSHHNXG4wAAAQ4"]
[Mon Apr 13 23:07:53.538861 2026] [:error] [pid 7228:tid 7237] [client 20.240.142.13:19520] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fetch.php"] [unique_id "ad0GyQEnn1dQrOSHHNXG5gAAAQc"]
[Mon Apr 13 23:07:54.262610 2026] [:error] [pid 63406:tid 63419] [client 20.240.142.13:19577] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fetch.php"] [unique_id "ad0GyrHZEIkQ0Zmgp5oXZQAAAMg"]
[Mon Apr 13 23:07:54.892411 2026] [:error] [pid 7228:tid 7240] [client 20.240.142.13:21001] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fetch.php"] [unique_id "ad0GygEnn1dQrOSHHNXG6gAAAQo"]
[Mon Apr 13 23:07:55.510055 2026] [:error] [pid 57183:tid 57209] [client 20.240.142.13:37742] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "ad0GyzDO3t8R5NaxzYSN-AAAAVg"]
[Mon Apr 13 23:07:56.168548 2026] [:error] [pid 9314:tid 9319] [client 20.240.142.13:21018] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "ad0GzG_r4W8fX2GWyGRYVwAAAYM"]
[Mon Apr 13 23:07:56.857828 2026] [:error] [pid 9314:tid 9331] [client 20.240.142.13:12985] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "ad0GzG_r4W8fX2GWyGRYWwAAAY8"]
[Mon Apr 13 23:07:57.605439 2026] [:error] [pid 9314:tid 9330] [client 20.240.142.13:26052] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/eFpU3yHnriNNLtvdefault.php"] [unique_id "ad0GzW_r4W8fX2GWyGRYYAAAAY4"]
[Mon Apr 13 23:07:58.654860 2026] [:error] [pid 7228:tid 7251] [client 20.240.142.13:23246] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "ad0GzgEnn1dQrOSHHNXG8wAAARU"]
[Mon Apr 13 23:07:59.668650 2026] [:error] [pid 63310:tid 63346] [client 20.240.142.13:37734] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "ad0Gz3oXpRU5ztmwPjJ5awAAAEI"]
[Mon Apr 13 23:08:00.258332 2026] [:error] [pid 63311:tid 63383] [client 20.240.142.13:19522] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "ad0G0KHjrGN1MqBCVFkqSAAAAIw"]
[Mon Apr 13 23:08:00.905684 2026] [:error] [pid 63310:tid 63364] [client 20.240.142.13:21050] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/2nzyHnOkEg.php"] [unique_id "ad0G0HoXpRU5ztmwPjJ5bwAAAFQ"]
[Mon Apr 13 23:08:01.695033 2026] [:error] [pid 63406:tid 63428] [client 20.240.142.13:19580] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/oircv.php"] [unique_id "ad0G0bHZEIkQ0Zmgp5oXdwAAANE"]
[Mon Apr 13 23:08:02.654712 2026] [:error] [pid 63406:tid 63416] [client 20.240.142.13:23239] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/oircv.php"] [unique_id "ad0G0rHZEIkQ0Zmgp5oXfgAAAMU"]
[Mon Apr 13 23:08:03.485992 2026] [:error] [pid 7228:tid 7251] [client 20.240.142.13:26037] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/oircv.php"] [unique_id "ad0G0wEnn1dQrOSHHNXG-gAAARU"]
[Mon Apr 13 23:08:04.221605 2026] [:error] [pid 57183:tid 57208] [client 20.240.142.13:11534] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/oircv.php"] [unique_id "ad0G1DDO3t8R5NaxzYSOBgAAAVc"]
[Mon Apr 13 23:08:05.309860 2026] [:error] [pid 63310:tid 63344] [client 20.240.142.13:1494] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/blnux.php"] [unique_id "ad0G1XoXpRU5ztmwPjJ5dQAAAEA"]
[Mon Apr 13 23:08:06.037072 2026] [:error] [pid 63406:tid 63423] [client 20.240.142.13:26004] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/blnux.php"] [unique_id "ad0G1rHZEIkQ0Zmgp5oXhAAAAMw"]
[Mon Apr 13 23:08:06.814495 2026] [:error] [pid 63406:tid 63420] [client 20.240.142.13:16724] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/blnux.php"] [unique_id "ad0G1rHZEIkQ0Zmgp5oXiwAAAMk"]
[Mon Apr 13 23:08:09.817602 2026] [:error] [pid 9314:tid 9335] [client 20.240.142.13:11573] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/blnux.php"] [unique_id "ad0G2W_r4W8fX2GWyGRYcgAAAZM"]
[Mon Apr 13 23:08:11.551412 2026] [:error] [pid 57183:tid 57202] [client 20.240.142.13:26009] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "ad0G2zDO3t8R5NaxzYSOEAAAAVE"]
[Mon Apr 13 23:08:13.489658 2026] [:error] [pid 63311:tid 63383] [client 20.240.142.13:26024] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "ad0G3aHjrGN1MqBCVFkqXAAAAIw"]
[Mon Apr 13 23:08:15.333207 2026] [:error] [pid 63310:tid 63355] [client 20.240.142.13:11552] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "ad0G33oXpRU5ztmwPjJ5ewAAAEs"]
[Mon Apr 13 23:08:17.116075 2026] [:error] [pid 63406:tid 63431] [client 20.240.142.13:11550] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/n3yUmQ6Q9xwQ8ocdefault.php"] [unique_id "ad0G4bHZEIkQ0Zmgp5oXqAAAANQ"]
[Mon Apr 13 23:08:18.872797 2026] [:error] [pid 57183:tid 57208] [client 20.240.142.13:22858] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Spow_SRw.php"] [unique_id "ad0G4jDO3t8R5NaxzYSOGgAAAVc"]
[Mon Apr 13 23:08:20.064809 2026] [:error] [pid 63406:tid 63429] [client 20.240.142.13:19536] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Spow_SRw.php"] [unique_id "ad0G5LHZEIkQ0Zmgp5oXtAAAANI"]
[Mon Apr 13 23:08:21.055799 2026] [:error] [pid 63406:tid 63432] [client 20.240.142.13:23292] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Spow_SRw.php"] [unique_id "ad0G5bHZEIkQ0Zmgp5oXuwAAANU"]
[Mon Apr 13 23:08:22.304078 2026] [:error] [pid 63406:tid 63414] [client 20.240.142.13:23651] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Spow_SRw.php"] [unique_id "ad0G5rHZEIkQ0Zmgp5oXwwAAAMM"]
[Mon Apr 13 23:08:23.145283 2026] [:error] [pid 63310:tid 63351] [client 20.240.142.13:23643] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/albrt.php"] [unique_id "ad0G53oXpRU5ztmwPjJ5gQAAAEc"]
[Mon Apr 13 23:08:23.715825 2026] [:error] [pid 57183:tid 57206] [client 20.240.142.13:16704] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/albrt.php"] [unique_id "ad0G5zDO3t8R5NaxzYSONQAAAVU"]
[Mon Apr 13 23:08:24.285288 2026] [:error] [pid 63406:tid 63417] [client 20.240.142.13:11574] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/albrt.php"] [unique_id "ad0G6LHZEIkQ0Zmgp5oXzgAAAMY"]
[Mon Apr 13 23:08:24.835481 2026] [:error] [pid 9314:tid 9329] [client 20.240.142.13:27279] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/albrt.php"] [unique_id "ad0G6G_r4W8fX2GWyGRYoQAAAY0"]
[Mon Apr 13 23:08:25.637213 2026] [:error] [pid 63406:tid 63425] [client 20.240.142.13:44992] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xxivicLhot.php"] [unique_id "ad0G6bHZEIkQ0Zmgp5oX1gAAAM4"]
[Mon Apr 13 23:08:26.335851 2026] [:error] [pid 63406:tid 63418] [client 20.240.142.13:11555] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xxivicLhot.php"] [unique_id "ad0G6rHZEIkQ0Zmgp5oX3gAAAMc"]
[Mon Apr 13 23:08:27.501981 2026] [:error] [pid 63406:tid 63425] [client 20.240.142.13:36064] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xxivicLhot.php"] [unique_id "ad0G67HZEIkQ0Zmgp5oX5AAAAM4"]
[Mon Apr 13 23:08:29.095474 2026] [:error] [pid 63406:tid 63426] [client 20.240.142.13:44997] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xxivicLhot.php"] [unique_id "ad0G7bHZEIkQ0Zmgp5oX6wAAAM8"]
[Mon Apr 13 23:08:30.228093 2026] [:error] [pid 63406:tid 63415] [client 20.240.142.13:21029] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/7logs.php"] [unique_id "ad0G7rHZEIkQ0Zmgp5oX-wAAAMQ"]
[Mon Apr 13 23:08:30.930999 2026] [:error] [pid 63310:tid 63365] [client 20.240.142.13:23260] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/7logs.php"] [unique_id "ad0G7noXpRU5ztmwPjJ5jQAAAFU"]
[Mon Apr 13 23:08:31.806431 2026] [:error] [pid 63406:tid 63432] [client 20.240.142.13:12976] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/7logs.php"] [unique_id "ad0G77HZEIkQ0Zmgp5oYBwAAANU"]
[Mon Apr 13 23:08:32.631766 2026] [:error] [pid 63406:tid 63435] [client 20.240.142.13:19582] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/7logs.php"] [unique_id "ad0G8LHZEIkQ0Zmgp5oYEQAAANg"]
[Mon Apr 13 23:08:33.494375 2026] [:error] [pid 57183:tid 57186] [client 20.240.142.13:11559] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/acc.php"] [unique_id "ad0G8TDO3t8R5NaxzYSOOgAAAUE"]
[Mon Apr 13 23:08:34.386301 2026] [:error] [pid 63406:tid 63414] [client 20.240.142.13:23281] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/acc.php"] [unique_id "ad0G8rHZEIkQ0Zmgp5oYIwAAAMM"]
[Mon Apr 13 23:08:35.549914 2026] [:error] [pid 63406:tid 63417] [client 20.240.142.13:21003] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/acc.php"] [unique_id "ad0G87HZEIkQ0Zmgp5oYLQAAAMY"]
[Mon Apr 13 23:08:36.258572 2026] [:error] [pid 63311:tid 63377] [client 20.240.142.13:36084] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/acc.php"] [unique_id "ad0G9KHjrGN1MqBCVFkqcAAAAIY"]
[Mon Apr 13 23:08:36.964629 2026] [:error] [pid 57183:tid 57205] [client 20.240.142.13:19182] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wxeyc.php"] [unique_id "ad0G9DDO3t8R5NaxzYSOSAAAAVQ"]
[Mon Apr 13 23:08:38.029792 2026] [:error] [pid 57183:tid 57194] [client 20.240.142.13:45025] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wxeyc.php"] [unique_id "ad0G9jDO3t8R5NaxzYSOSQAAAUk"]
[Mon Apr 13 23:08:45.654286 2026] [:error] [pid 63311:tid 63371] [client 20.240.142.13:14669] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wpb.php"] [unique_id "ad0G_aHjrGN1MqBCVFkqfAAAAIA"]
[Mon Apr 13 23:08:49.885520 2026] [:error] [pid 57183:tid 57196] [client 20.240.142.13:17772] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wpb.php"] [unique_id "ad0HATDO3t8R5NaxzYSOXAAAAUs"]
[Mon Apr 13 23:08:55.268883 2026] [:error] [pid 63406:tid 63420] [client 20.240.142.13:25995] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wpb.php"] [unique_id "ad0HB7HZEIkQ0Zmgp5oYuAAAAMk"]
[Mon Apr 13 23:08:56.756464 2026] [:error] [pid 57183:tid 57201] [client 20.240.142.13:41622] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wpb.php"] [unique_id "ad0HCDDO3t8R5NaxzYSOfgAAAVA"]
[Mon Apr 13 23:08:58.042674 2026] [:error] [pid 57183:tid 57194] [client 20.240.142.13:25990] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Geforce.php"] [unique_id "ad0HCjDO3t8R5NaxzYSOiAAAAUk"]
[Mon Apr 13 23:08:59.566633 2026] [:error] [pid 57183:tid 57207] [client 20.240.142.13:22484] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Geforce.php"] [unique_id "ad0HCzDO3t8R5NaxzYSOlgAAAVY"]
[Mon Apr 13 23:09:04.232016 2026] [:error] [pid 63406:tid 63423] [client 20.240.142.13:35552] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Geforce.php"] [unique_id "ad0HELHZEIkQ0Zmgp5oY4QAAAMw"]
[Mon Apr 13 23:09:07.919762 2026] [:error] [pid 57183:tid 57192] [client 20.240.142.13:43853] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Geforce.php"] [unique_id "ad0HEzDO3t8R5NaxzYSOvQAAAUc"]
[Mon Apr 13 23:09:09.184797 2026] [:error] [pid 63406:tid 63426] [client 20.240.142.13:1768] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/9EaklzMysJ.php"] [unique_id "ad0HFbHZEIkQ0Zmgp5oY7gAAAM8"]
[Mon Apr 13 23:09:09.971701 2026] [:error] [pid 63406:tid 63425] [client 20.240.142.13:39028] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/9EaklzMysJ.php"] [unique_id "ad0HFbHZEIkQ0Zmgp5oY8wAAAM4"]
[Mon Apr 13 23:09:10.986509 2026] [:error] [pid 63311:tid 63385] [client 20.240.142.13:19095] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/9EaklzMysJ.php"] [unique_id "ad0HFqHjrGN1MqBCVFkqkgAAAI4"]
[Mon Apr 13 23:09:11.976858 2026] [:error] [pid 63406:tid 63420] [client 20.240.142.13:48636] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/9EaklzMysJ.php"] [unique_id "ad0HF7HZEIkQ0Zmgp5oY-QAAAMk"]
[Mon Apr 13 23:09:12.764906 2026] [:error] [pid 63406:tid 63429] [client 20.240.142.13:37074] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wpxl.php"] [unique_id "ad0HGLHZEIkQ0Zmgp5oY_QAAANI"]
[Mon Apr 13 23:09:13.776380 2026] [:error] [pid 63406:tid 63432] [client 20.240.142.13:40108] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wpxl.php"] [unique_id "ad0HGbHZEIkQ0Zmgp5oZBQAAANU"]
[Mon Apr 13 23:09:14.808253 2026] [:error] [pid 7228:tid 7248] [client 20.240.142.13:45454] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wpxl.php"] [unique_id "ad0HGgEnn1dQrOSHHNXHTwAAARI"]
[Mon Apr 13 23:09:15.380542 2026] [:error] [pid 63406:tid 63428] [client 20.240.142.13:15049] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wpxl.php"] [unique_id "ad0HG7HZEIkQ0Zmgp5oZCQAAANE"]
[Mon Apr 13 23:09:16.037343 2026] [:error] [pid 63311:tid 63373] [client 20.240.142.13:27917] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "ad0HHKHjrGN1MqBCVFkqowAAAII"]
[Mon Apr 13 23:09:16.724783 2026] [:error] [pid 63311:tid 63386] [client 20.240.142.13:48612] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "ad0HHKHjrGN1MqBCVFkqpgAAAI8"]
[Mon Apr 13 23:09:17.681950 2026] [:error] [pid 63311:tid 63395] [client 20.240.142.13:40092] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "ad0HHaHjrGN1MqBCVFkqrAAAAJg"]
[Mon Apr 13 23:09:18.577943 2026] [:error] [pid 63311:tid 63386] [client 20.240.142.13:37067] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/s3FiyJ2WGCnF0p1default.php"] [unique_id "ad0HHqHjrGN1MqBCVFkqswAAAI8"]
[Mon Apr 13 23:09:19.486726 2026] [:error] [pid 63311:tid 63395] [client 20.240.142.13:20668] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bfil.php"] [unique_id "ad0HH6HjrGN1MqBCVFkqugAAAJg"]
[Mon Apr 13 23:09:20.479723 2026] [:error] [pid 63406:tid 63420] [client 20.240.142.13:20644] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bfil.php"] [unique_id "ad0HILHZEIkQ0Zmgp5oZEgAAAMk"]
[Mon Apr 13 23:09:21.561036 2026] [:error] [pid 63406:tid 63435] [client 20.240.142.13:19107] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bfil.php"] [unique_id "ad0HIbHZEIkQ0Zmgp5oZFgAAANg"]
[Mon Apr 13 23:09:23.062554 2026] [:error] [pid 7228:tid 7245] [client 20.240.142.13:15052] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bfil.php"] [unique_id "ad0HIwEnn1dQrOSHHNXHVgAAAQ8"]
[Mon Apr 13 23:09:25.461516 2026] [:error] [pid 9314:tid 9323] [client 20.240.142.13:20302] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lb.php"] [unique_id "ad0HJW_r4W8fX2GWyGRY_wAAAYc"]
[Mon Apr 13 23:09:27.611490 2026] [:error] [pid 63406:tid 63421] [client 20.240.142.13:37113] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lb.php"] [unique_id "ad0HJ7HZEIkQ0Zmgp5oZNAAAAMo"]
[Mon Apr 13 23:09:29.450773 2026] [:error] [pid 9314:tid 9339] [client 20.240.142.13:20661] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lb.php"] [unique_id "ad0HKW_r4W8fX2GWyGRZFgAAAZc"]
[Mon Apr 13 23:09:30.687514 2026] [:error] [pid 63406:tid 63411] [client 20.240.142.13:13828] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lb.php"] [unique_id "ad0HKrHZEIkQ0Zmgp5oZRwAAAMA"]
[Mon Apr 13 23:09:31.520884 2026] [:error] [pid 63309:tid 63314] [client 20.240.142.13:48602] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/dx.php"] [unique_id "ad0HK0pIKZ10weXpf0VDZAAAAAE"]
[Mon Apr 13 23:09:32.516608 2026] [:error] [pid 63406:tid 63420] [client 20.240.142.13:27954] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/dx.php"] [unique_id "ad0HLLHZEIkQ0Zmgp5oZTwAAAMk"]
[Mon Apr 13 23:09:33.328605 2026] [:error] [pid 57183:tid 57192] [client 20.240.142.13:13833] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/dx.php"] [unique_id "ad0HLTDO3t8R5NaxzYSPFAAAAUc"]
[Mon Apr 13 23:09:33.973371 2026] [:error] [pid 57183:tid 57209] [client 20.240.142.13:17112] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/dx.php"] [unique_id "ad0HLTDO3t8R5NaxzYSPFgAAAVg"]
[Mon Apr 13 23:09:34.998833 2026] [:error] [pid 63406:tid 63427] [client 20.240.142.13:27937] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/menu.php"] [unique_id "ad0HLrHZEIkQ0Zmgp5oZXAAAANA"]
[Mon Apr 13 23:09:35.699792 2026] [:error] [pid 63309:tid 63333] [client 20.240.142.13:20331] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/menu.php"] [unique_id "ad0HL0pIKZ10weXpf0VDawAAABQ"]
[Mon Apr 13 23:09:36.650572 2026] [:error] [pid 63311:tid 63395] [client 20.240.142.13:13862] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/menu.php"] [unique_id "ad0HMKHjrGN1MqBCVFkq0wAAAJg"]
[Mon Apr 13 23:09:37.697212 2026] [:error] [pid 7228:tid 7246] [client 20.240.142.13:48625] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/menu.php"] [unique_id "ad0HMQEnn1dQrOSHHNXHmAAAARA"]
[Mon Apr 13 23:09:38.546322 2026] [:error] [pid 7228:tid 7245] [client 20.240.142.13:27948] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "ad0HMgEnn1dQrOSHHNXHnQAAAQ8"]
[Mon Apr 13 23:09:40.469319 2026] [:error] [pid 63406:tid 63419] [client 20.240.142.13:45457] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "ad0HNLHZEIkQ0Zmgp5oZdgAAAMg"]
[Mon Apr 13 23:09:43.288569 2026] [:error] [pid 63310:tid 63345] [client 20.240.142.13:30912] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/p14rAeWytPdH5hZcscCFdefault.php"] [unique_id "ad0HN3oXpRU5ztmwPjJ5yAAAAEE"]
[Mon Apr 13 23:09:49.727391 2026] [:error] [pid 57183:tid 57193] [client 20.240.142.13:40072] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "ad0HPTDO3t8R5NaxzYSPQAAAAUg"]
[Mon Apr 13 23:09:51.267664 2026] [:error] [pid 57183:tid 57198] [client 20.240.142.13:30957] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "ad0HPzDO3t8R5NaxzYSPUQAAAU0"]
[Mon Apr 13 23:09:52.633661 2026] [:error] [pid 57183:tid 57196] [client 20.240.142.13:20667] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "ad0HQDDO3t8R5NaxzYSPWQAAAUs"]
[Mon Apr 13 23:09:54.095274 2026] [:error] [pid 7228:tid 7247] [client 20.240.142.13:1447] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/iee52ruz0s81ndrdefault.php"] [unique_id "ad0HQgEnn1dQrOSHHNXHsQAAARE"]
[Mon Apr 13 23:09:54.926638 2026] [:error] [pid 63311:tid 63387] [client 20.240.142.13:21655] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "ad0HQqHjrGN1MqBCVFkq6wAAAJA"]
[Mon Apr 13 23:09:56.083615 2026] [:error] [pid 7228:tid 7236] [client 20.240.142.13:1461] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "ad0HRAEnn1dQrOSHHNXHtwAAAQY"]
[Mon Apr 13 23:09:56.952585 2026] [:error] [pid 63311:tid 63390] [client 20.240.142.13:24746] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "ad0HRKHjrGN1MqBCVFkq7AAAAJM"]
[Mon Apr 13 23:09:58.470130 2026] [:error] [pid 63406:tid 63431] [client 20.240.142.13:45483] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nvwf4svpvqohxdjtbjCdefault.php"] [unique_id "ad0HRrHZEIkQ0Zmgp5oZuAAAANQ"]
[Mon Apr 13 23:09:59.849813 2026] [:error] [pid 9314:tid 9332] [client 20.240.142.13:30974] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/zc-220.php"] [unique_id "ad0HR2_r4W8fX2GWyGRZXgAAAZA"]
[Mon Apr 13 23:10:01.108661 2026] [:error] [pid 9314:tid 9339] [client 20.240.142.13:40114] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/zc-220.php"] [unique_id "ad0HSW_r4W8fX2GWyGRZYgAAAZc"]
[Mon Apr 13 23:10:03.248384 2026] [:error] [pid 63406:tid 63416] [client 20.240.142.13:1443] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/zc-220.php"] [unique_id "ad0HS7HZEIkQ0Zmgp5oZ1wAAAMU"]
[Mon Apr 13 23:10:05.871652 2026] [:error] [pid 9314:tid 9330] [client 20.240.142.13:1431] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/zc-220.php"] [unique_id "ad0HTW_r4W8fX2GWyGRZaQAAAY4"]
[Mon Apr 13 23:10:07.684954 2026] [:error] [pid 63309:tid 63327] [client 20.240.142.13:24726] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "ad0HT0pIKZ10weXpf0VDeQAAAA4"]
[Mon Apr 13 23:10:10.602570 2026] [:error] [pid 63406:tid 63428] [client 20.240.142.13:27935] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "ad0HUrHZEIkQ0Zmgp5oZ-wAAANE"]
[Mon Apr 13 23:10:12.356367 2026] [:error] [pid 63310:tid 63346] [client 20.240.142.13:37062] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "ad0HVHoXpRU5ztmwPjJ53AAAAEI"]
[Mon Apr 13 23:10:13.461394 2026] [:error] [pid 63311:tid 63376] [client 20.240.142.13:1409] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/r9pbhistk1lifhnjadpCdefault.php"] [unique_id "ad0HVaHjrGN1MqBCVFkq8wAAAIU"]
[Mon Apr 13 23:10:14.515671 2026] [:error] [pid 63310:tid 63360] [client 20.240.142.13:27926] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fone1.php"] [unique_id "ad0HVnoXpRU5ztmwPjJ55AAAAFA"]
[Mon Apr 13 23:10:15.965183 2026] [:error] [pid 57183:tid 57194] [client 20.240.142.13:48616] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fone1.php"] [unique_id "ad0HVzDO3t8R5NaxzYSPeQAAAUk"]
[Mon Apr 13 23:10:16.627602 2026] [:error] [pid 57183:tid 57191] [client 20.240.142.13:1438] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fone1.php"] [unique_id "ad0HWDDO3t8R5NaxzYSPfAAAAUY"]
[Mon Apr 13 23:10:17.633599 2026] [:error] [pid 9314:tid 9337] [client 20.240.142.13:24742] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/fone1.php"] [unique_id "ad0HWW_r4W8fX2GWyGRZhQAAAZU"]
[Mon Apr 13 23:10:19.427584 2026] [:error] [pid 9314:tid 9333] [client 20.240.142.13:48606] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xxiviLDIot.php"] [unique_id "ad0HW2_r4W8fX2GWyGRZiAAAAZE"]
[Mon Apr 13 23:10:21.449023 2026] [:error] [pid 63309:tid 63330] [client 20.240.142.13:21666] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xxiviLDIot.php"] [unique_id "ad0HXUpIKZ10weXpf0VDgAAAABE"]
[Mon Apr 13 23:10:22.297381 2026] [:error] [pid 57183:tid 57205] [client 20.240.142.13:27909] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xxiviLDIot.php"] [unique_id "ad0HXjDO3t8R5NaxzYSPiwAAAVQ"]
[Mon Apr 13 23:10:24.347751 2026] [:error] [pid 63406:tid 63412] [client 20.240.142.13:45464] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xxiviLDIot.php"] [unique_id "ad0HYLHZEIkQ0Zmgp5oaGgAAAME"]
[Mon Apr 13 23:10:27.869788 2026] [:error] [pid 9314:tid 9316] [client 20.240.142.13:27904] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hanyatersenyum.php"] [unique_id "ad0HY2_r4W8fX2GWyGRZpgAAAYA"]
[Mon Apr 13 23:10:31.497356 2026] [:error] [pid 63309:tid 63319] [client 20.240.142.13:20636] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hanyatersenyum.php"] [unique_id "ad0HZ0pIKZ10weXpf0VDigAAAAY"]
[Mon Apr 13 23:10:32.926199 2026] [:error] [pid 57183:tid 57192] [client 20.240.142.13:45482] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hanyatersenyum.php"] [unique_id "ad0HaDDO3t8R5NaxzYSPngAAAUc"]
[Mon Apr 13 23:10:34.510598 2026] [:error] [pid 7228:tid 7242] [client 20.240.142.13:20669] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/hanyatersenyum.php"] [unique_id "ad0HagEnn1dQrOSHHNXH9QAAAQw"]
[Mon Apr 13 23:10:35.898332 2026] [:error] [pid 9314:tid 9331] [client 20.240.142.13:33180] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "ad0Ha2_r4W8fX2GWyGRZtQAAAY8"]
[Mon Apr 13 23:10:36.677574 2026] [:error] [pid 57183:tid 57185] [client 20.240.142.13:45477] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "ad0HbDDO3t8R5NaxzYSPpgAAAUA"]
[Mon Apr 13 23:10:37.755977 2026] [:error] [pid 7228:tid 7253] [client 20.240.142.13:33198] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "ad0HbQEnn1dQrOSHHNXIBgAAARc"]
[Mon Apr 13 23:10:39.486295 2026] [:error] [pid 57183:tid 57195] [client 20.240.142.13:13831] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/5tdwvyWnTbRiMS8f18HXNBbALHKB5t4j.php"] [unique_id "ad0HbzDO3t8R5NaxzYSPrQAAAUo"]
[Mon Apr 13 23:10:40.395661 2026] [:error] [pid 63309:tid 63334] [client 20.240.142.13:1121] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/upll22.php"] [unique_id "ad0HcEpIKZ10weXpf0VDjwAAABU"]
[Mon Apr 13 23:10:41.328472 2026] [:error] [pid 7228:tid 7241] [client 20.240.142.13:19091] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/upll22.php"] [unique_id "ad0HcQEnn1dQrOSHHNXIDwAAAQs"]
[Mon Apr 13 23:10:42.013786 2026] [:error] [pid 63311:tid 63373] [client 20.240.142.13:1780] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/upll22.php"] [unique_id "ad0HcqHjrGN1MqBCVFkrCwAAAII"]
[Mon Apr 13 23:10:42.898097 2026] [:error] [pid 63309:tid 63332] [client 20.240.142.13:17135] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/upll22.php"] [unique_id "ad0HckpIKZ10weXpf0VDlgAAABM"]
[Mon Apr 13 23:10:43.723868 2026] [:error] [pid 63406:tid 63413] [client 20.240.142.13:22475] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/100.php"] [unique_id "ad0Hc7HZEIkQ0Zmgp5oaOgAAAMI"]
[Mon Apr 13 23:10:44.462261 2026] [:error] [pid 63406:tid 63423] [client 20.240.142.13:35566] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/100.php"] [unique_id "ad0HdLHZEIkQ0Zmgp5oaQgAAAMw"]
[Mon Apr 13 23:10:47.023938 2026] [:error] [pid 57183:tid 57207] [client 20.240.142.13:11526] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/100.php"] [unique_id "ad0HdzDO3t8R5NaxzYSPwAAAAVY"]
[Mon Apr 13 23:11:19.926931 2026] [:error] [pid 63309:tid 63327] [client 20.240.142.13:29611] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX1.php"] [unique_id "ad0Hl0pIKZ10weXpf0VDtAAAAA4"]
[Mon Apr 13 23:11:22.089371 2026] [:error] [pid 63310:tid 63365] [client 20.240.142.13:43982] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX1.php"] [unique_id "ad0HmnoXpRU5ztmwPjJ6NwAAAFU"]
[Mon Apr 13 23:11:25.545273 2026] [:error] [pid 57183:tid 57190] [client 20.240.142.13:39650] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX1.php"] [unique_id "ad0HnTDO3t8R5NaxzYSQDwAAAUU"]
[Mon Apr 13 23:11:28.195645 2026] [:error] [pid 63406:tid 63414] [client 20.240.142.13:45419] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX1.php"] [unique_id "ad0HoLHZEIkQ0Zmgp5oa7gAAAMM"]
[Mon Apr 13 23:11:29.313621 2026] [:error] [pid 63406:tid 63419] [client 20.240.142.13:22429] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "ad0HobHZEIkQ0Zmgp5oa-AAAAMg"]
[Mon Apr 13 23:11:30.138168 2026] [:error] [pid 9314:tid 9332] [client 20.240.142.13:17068] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "ad0Hom_r4W8fX2GWyGRaAwAAAZA"]
[Mon Apr 13 23:11:31.375826 2026] [:error] [pid 7228:tid 7237] [client 20.240.142.13:22406] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "ad0HowEnn1dQrOSHHNXIQQAAAQc"]
[Mon Apr 13 23:11:32.685979 2026] [:error] [pid 9314:tid 9330] [client 20.240.142.13:18717] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gvg1bvpsgtot1rpklCdefault.php"] [unique_id "ad0HpG_r4W8fX2GWyGRaCgAAAY4"]
[Mon Apr 13 23:11:33.633774 2026] [:error] [pid 63406:tid 63422] [client 20.240.142.13:22423] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ad0HpbHZEIkQ0Zmgp5obFQAAAMs"]
[Mon Apr 13 23:11:34.488952 2026] [:error] [pid 63406:tid 63415] [client 20.240.142.13:1600] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ad0HprHZEIkQ0Zmgp5obHgAAAMQ"]
[Mon Apr 13 23:11:35.325070 2026] [:error] [pid 63406:tid 63418] [client 20.240.142.13:28443] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ad0Hp7HZEIkQ0Zmgp5obJAAAAMc"]
[Mon Apr 13 23:11:35.979414 2026] [:error] [pid 9314:tid 9337] [client 20.240.142.13:28451] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/6xBAm3vODE05BSzkJZRAws.php"] [unique_id "ad0Hp2_r4W8fX2GWyGRaDgAAAZU"]
[Mon Apr 13 23:11:36.826852 2026] [:error] [pid 57183:tid 57204] [client 20.240.142.13:36551] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/aligk.php"] [unique_id "ad0HqDDO3t8R5NaxzYSQIQAAAVM"]
[Mon Apr 13 23:11:37.802793 2026] [:error] [pid 63309:tid 63333] [client 20.240.142.13:30321] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/aligk.php"] [unique_id "ad0HqUpIKZ10weXpf0VDvAAAABQ"]
[Mon Apr 13 23:11:38.848748 2026] [:error] [pid 63406:tid 63411] [client 20.240.142.13:31403] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/aligk.php"] [unique_id "ad0HqrHZEIkQ0Zmgp5obMwAAAMA"]
[Mon Apr 13 23:11:40.368121 2026] [:error] [pid 63406:tid 63412] [client 20.240.142.13:1905] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/aligk.php"] [unique_id "ad0HrLHZEIkQ0Zmgp5obPwAAAME"]
[Mon Apr 13 23:11:41.606983 2026] [:error] [pid 7228:tid 7238] [client 20.240.142.13:39635] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file61.php"] [unique_id "ad0HrQEnn1dQrOSHHNXISAAAAQg"]
[Mon Apr 13 23:11:42.408323 2026] [:error] [pid 63406:tid 63411] [client 20.240.142.13:36598] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file61.php"] [unique_id "ad0HrrHZEIkQ0Zmgp5obSAAAAMA"]
[Mon Apr 13 23:11:43.405402 2026] [:error] [pid 63309:tid 63331] [client 20.240.142.13:19467] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file61.php"] [unique_id "ad0Hr0pIKZ10weXpf0VDvQAAABI"]
[Mon Apr 13 23:11:45.263497 2026] [:error] [pid 9314:tid 9339] [client 20.240.142.13:20692] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file61.php"] [unique_id "ad0HsW_r4W8fX2GWyGRaGgAAAZc"]
[Mon Apr 13 23:11:46.719462 2026] [:error] [pid 63406:tid 63432] [client 20.240.142.13:31374] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xwx1.php"] [unique_id "ad0HsrHZEIkQ0Zmgp5obVAAAANU"]
[Mon Apr 13 23:11:49.218931 2026] [:error] [pid 57183:tid 57185] [client 20.240.142.13:40713] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xwx1.php"] [unique_id "ad0HtTDO3t8R5NaxzYSQVAAAAUA"]
[Mon Apr 13 23:11:50.304024 2026] [:error] [pid 57183:tid 57209] [client 20.240.142.13:27998] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xwx1.php"] [unique_id "ad0HtjDO3t8R5NaxzYSQWQAAAVg"]
[Mon Apr 13 23:11:53.222867 2026] [:error] [pid 7228:tid 7245] [client 20.240.142.13:22050] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/xwx1.php"] [unique_id "ad0HuQEnn1dQrOSHHNXIVgAAAQ8"]
[Mon Apr 13 23:11:54.700879 2026] [:error] [pid 63406:tid 63422] [client 20.240.142.13:22058] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tx79.php"] [unique_id "ad0HurHZEIkQ0Zmgp5obaQAAAMs"]
[Mon Apr 13 23:11:56.740228 2026] [:error] [pid 7228:tid 7232] [client 20.240.142.13:44080] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tx79.php"] [unique_id "ad0HvAEnn1dQrOSHHNXIWwAAAQI"]
[Mon Apr 13 23:11:58.824637 2026] [:error] [pid 9314:tid 9324] [client 20.240.142.13:28989] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/tx79.php"] [unique_id "ad0Hvm_r4W8fX2GWyGRaMwAAAYg"]
[Mon Apr 13 23:12:11.930575 2026] [:error] [pid 63406:tid 63416] [client 20.240.142.13:45630] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX2.php"] [unique_id "ad0Hy7HZEIkQ0Zmgp5obgQAAAMU"]
[Mon Apr 13 23:12:14.023845 2026] [:error] [pid 63311:tid 63377] [client 20.240.142.13:2023] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX2.php"] [unique_id "ad0HzqHjrGN1MqBCVFkrhAAAAIY"]
[Mon Apr 13 23:12:15.806900 2026] [:error] [pid 63310:tid 63359] [client 20.240.142.13:14629] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX2.php"] [unique_id "ad0Hz3oXpRU5ztmwPjJ6owAAAE8"]
[Mon Apr 13 23:12:18.193902 2026] [:error] [pid 63309:tid 63327] [client 20.240.142.13:1995] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/CDX2.php"] [unique_id "ad0H0kpIKZ10weXpf0VD0wAAAA4"]
[Mon Apr 13 23:12:20.319850 2026] [:error] [pid 63311:tid 63376] [client 20.240.142.13:1625] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/666.php"] [unique_id "ad0H1KHjrGN1MqBCVFkroAAAAIU"]
[Mon Apr 13 23:12:23.035758 2026] [:error] [pid 57183:tid 57195] [client 20.240.142.13:42871] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/666.php"] [unique_id "ad0H1zDO3t8R5NaxzYSQagAAAUo"]
[Mon Apr 13 23:12:25.178186 2026] [:error] [pid 7228:tid 7240] [client 20.240.142.13:38941] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/666.php"] [unique_id "ad0H2QEnn1dQrOSHHNXIjQAAAQo"]
[Mon Apr 13 23:12:26.382339 2026] [:error] [pid 57183:tid 57201] [client 20.240.142.13:1509] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/666.php"] [unique_id "ad0H2jDO3t8R5NaxzYSQgQAAAVA"]
[Mon Apr 13 23:12:28.368542 2026] [:error] [pid 63310:tid 63348] [client 20.240.142.13:37718] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "ad0H3HoXpRU5ztmwPjJ6uAAAAEQ"]
[Mon Apr 13 23:12:30.713615 2026] [:error] [pid 57183:tid 57206] [client 20.240.142.13:44613] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "ad0H3jDO3t8R5NaxzYSQjwAAAVU"]
[Mon Apr 13 23:12:32.899421 2026] [:error] [pid 63406:tid 63435] [client 20.240.142.13:23200] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "ad0H4LHZEIkQ0Zmgp5obtgAAANg"]
[Mon Apr 13 23:12:37.630022 2026] [:error] [pid 63311:tid 63394] [client 20.240.142.13:37752] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wtiiy.php"] [unique_id "ad0H5aHjrGN1MqBCVFkruwAAAJc"]
[Mon Apr 13 23:12:40.522571 2026] [:error] [pid 57183:tid 57189] [client 20.240.142.13:16171] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Sanskrit.php"] [unique_id "ad0H6DDO3t8R5NaxzYSQrQAAAUQ"]
[Mon Apr 13 23:12:41.746333 2026] [:error] [pid 63406:tid 63423] [client 20.240.142.13:13927] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Sanskrit.php"] [unique_id "ad0H6bHZEIkQ0Zmgp5ob1wAAAMw"]
[Mon Apr 13 23:12:43.467824 2026] [:error] [pid 63310:tid 63351] [client 20.240.142.13:25539] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Sanskrit.php"] [unique_id "ad0H63oXpRU5ztmwPjJ6wQAAAEc"]
[Mon Apr 13 23:12:44.872495 2026] [:error] [pid 7228:tid 7254] [client 20.240.142.13:13949] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/Sanskrit.php"] [unique_id "ad0H7AEnn1dQrOSHHNXIngAAARg"]
[Mon Apr 13 23:12:46.246317 2026] [:error] [pid 57183:tid 57206] [client 20.240.142.13:13029] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/motu.php"] [unique_id "ad0H7jDO3t8R5NaxzYSQzAAAAVU"]
[Mon Apr 13 23:12:47.428767 2026] [:error] [pid 57183:tid 57199] [client 20.240.142.13:12000] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/motu.php"] [unique_id "ad0H7zDO3t8R5NaxzYSQ1QAAAU4"]
[Mon Apr 13 23:12:48.454936 2026] [:error] [pid 57183:tid 57186] [client 20.240.142.13:45547] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/motu.php"] [unique_id "ad0H8DDO3t8R5NaxzYSQ2wAAAUE"]
[Mon Apr 13 23:12:50.030770 2026] [:error] [pid 57183:tid 57208] [client 20.240.142.13:25572] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/motu.php"] [unique_id "ad0H8jDO3t8R5NaxzYSQ6gAAAVc"]
[Mon Apr 13 23:12:51.297201 2026] [:error] [pid 7228:tid 7234] [client 20.240.142.13:25593] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amax.php"] [unique_id "ad0H8wEnn1dQrOSHHNXIogAAAQQ"]
[Mon Apr 13 23:12:52.205336 2026] [:error] [pid 63406:tid 63411] [client 20.240.142.13:20227] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amax.php"] [unique_id "ad0H9LHZEIkQ0Zmgp5ob9wAAAMA"]
[Mon Apr 13 23:12:53.408835 2026] [:error] [pid 63311:tid 63386] [client 20.240.142.13:25560] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amax.php"] [unique_id "ad0H9aHjrGN1MqBCVFkryQAAAI8"]
[Mon Apr 13 23:12:54.509179 2026] [:error] [pid 63406:tid 63420] [client 20.240.142.13:23644] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/amax.php"] [unique_id "ad0H9rHZEIkQ0Zmgp5ocBAAAAMk"]
[Mon Apr 13 23:12:55.454599 2026] [:error] [pid 63406:tid 63434] [client 20.240.142.13:23252] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ad0H97HZEIkQ0Zmgp5ocCgAAANc"]
[Mon Apr 13 23:12:57.001653 2026] [:error] [pid 7228:tid 7231] [client 20.240.142.13:21304] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ad0H-QEnn1dQrOSHHNXIrgAAAQE"]
[Mon Apr 13 23:12:58.678505 2026] [:error] [pid 63309:tid 63317] [client 20.240.142.13:23659] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ad0H-kpIKZ10weXpf0VD6AAAAAQ"]
[Mon Apr 13 23:12:59.988250 2026] [:error] [pid 7228:tid 7249] [client 20.240.142.13:16130] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/public/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ad0H-wEnn1dQrOSHHNXIswAAARM"]
[Mon Apr 13 23:13:00.930324 2026] [:error] [pid 63310:tid 63368] [client 20.240.142.13:30259] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "ad0H_HoXpRU5ztmwPjJ6xQAAAFg"]
[Mon Apr 13 23:13:02.053922 2026] [:error] [pid 63406:tid 63431] [client 20.240.142.13:43913] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "ad0H_rHZEIkQ0Zmgp5ocJwAAANQ"]
[Mon Apr 13 23:13:03.244497 2026] [:error] [pid 63406:tid 63411] [client 20.240.142.13:16718] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "ad0H_7HZEIkQ0Zmgp5ocMQAAAMA"]
[Mon Apr 13 23:13:04.396989 2026] [:error] [pid 57183:tid 57200] [client 20.240.142.13:12992] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gifclass.php"] [unique_id "ad0IADDO3t8R5NaxzYSRFQAAAU8"]
[Mon Apr 13 23:13:05.915740 2026] [:error] [pid 63311:tid 63386] [client 20.240.142.13:23285] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-the.php"] [unique_id "ad0IAaHjrGN1MqBCVFkr1QAAAI8"]
[Mon Apr 13 23:13:07.847872 2026] [:error] [pid 63310:tid 63367] [client 20.240.142.13:43960] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-the.php"] [unique_id "ad0IA3oXpRU5ztmwPjJ6ywAAAFc"]
[Mon Apr 13 23:13:26.298360 2026] [:error] [pid 7228:tid 7236] [client 20.240.142.13:11577] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/kj.php"] [unique_id "ad0IFgEnn1dQrOSHHNXI5QAAAQY"]
[Mon Apr 13 23:13:27.968578 2026] [:error] [pid 57183:tid 57201] [client 20.240.142.13:11552] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/kj.php"] [unique_id "ad0IFzDO3t8R5NaxzYSRagAAAVA"]
[Mon Apr 13 23:13:32.721778 2026] [:error] [pid 57183:tid 57185] [client 20.240.142.13:12628] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/kj.php"] [unique_id "ad0IHDDO3t8R5NaxzYSRcwAAAUA"]
[Mon Apr 13 23:13:33.627424 2026] [:error] [pid 63311:tid 63391] [client 20.240.142.13:16760] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/kj.php"] [unique_id "ad0IHaHjrGN1MqBCVFksEgAAAJQ"]
[Mon Apr 13 23:13:34.729504 2026] [:error] [pid 63406:tid 63417] [client 20.240.142.13:12662] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a7.php"] [unique_id "ad0IHrHZEIkQ0Zmgp5ocuQAAAMY"]
[Mon Apr 13 23:13:36.097157 2026] [:error] [pid 63406:tid 63432] [client 20.240.142.13:19581] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a7.php"] [unique_id "ad0IILHZEIkQ0Zmgp5ocxAAAANU"]
[Mon Apr 13 23:13:37.600179 2026] [:error] [pid 7228:tid 7242] [client 20.240.142.13:29012] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a7.php"] [unique_id "ad0IIQEnn1dQrOSHHNXJAAAAAQw"]
[Mon Apr 13 23:13:39.637531 2026] [:error] [pid 63406:tid 63419] [client 20.240.142.13:45002] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a7.php"] [unique_id "ad0II7HZEIkQ0Zmgp5oc4AAAAMg"]
[Mon Apr 13 23:13:40.390636 2026] [:error] [pid 63406:tid 63414] [client 20.240.142.13:14664] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "ad0IJLHZEIkQ0Zmgp5oc6QAAAMM"]
[Mon Apr 13 23:13:41.665180 2026] [:error] [pid 63406:tid 63419] [client 20.240.142.13:11548] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "ad0IJbHZEIkQ0Zmgp5oc9gAAAMg"]
[Mon Apr 13 23:13:42.326473 2026] [:error] [pid 63310:tid 63346] [client 20.240.142.13:12634] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "ad0IJnoXpRU5ztmwPjJ67gAAAEI"]
[Mon Apr 13 23:13:43.301836 2026] [:error] [pid 9314:tid 9334] [client 20.240.142.13:43935] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bgymj.php"] [unique_id "ad0IJ2_r4W8fX2GWyGRaqQAAAZI"]
[Mon Apr 13 23:13:44.609365 2026] [:error] [pid 63310:tid 63357] [client 20.240.142.13:27276] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lib.php"] [unique_id "ad0IKHoXpRU5ztmwPjJ69wAAAE0"]
[Mon Apr 13 23:13:45.269002 2026] [:error] [pid 7228:tid 7250] [client 20.240.142.13:19137] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lib.php"] [unique_id "ad0IKQEnn1dQrOSHHNXJEgAAARQ"]
[Mon Apr 13 23:13:45.801397 2026] [:error] [pid 63406:tid 63422] [client 20.240.142.13:36054] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lib.php"] [unique_id "ad0IKbHZEIkQ0Zmgp5odCAAAAMs"]
[Mon Apr 13 23:13:46.691758 2026] [:error] [pid 9314:tid 9335] [client 20.240.142.13:19538] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/lib.php"] [unique_id "ad0IKm_r4W8fX2GWyGRasgAAAZM"]
[Mon Apr 13 23:13:47.442947 2026] [:error] [pid 7228:tid 7249] [client 20.240.142.13:45000] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bolt.php"] [unique_id "ad0IKwEnn1dQrOSHHNXJFAAAARM"]
[Mon Apr 13 23:13:48.200098 2026] [:error] [pid 7228:tid 7248] [client 20.240.142.13:19535] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bolt.php"] [unique_id "ad0ILAEnn1dQrOSHHNXJGwAAARI"]
[Mon Apr 13 23:13:49.178102 2026] [:error] [pid 63406:tid 63420] [client 20.240.142.13:26020] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bolt.php"] [unique_id "ad0ILbHZEIkQ0Zmgp5odGAAAAMk"]
[Mon Apr 13 23:13:50.101109 2026] [:error] [pid 9314:tid 9325] [client 20.240.142.13:46892] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/bolt.php"] [unique_id "ad0ILm_r4W8fX2GWyGRatwAAAYk"]
[Mon Apr 13 23:13:51.067699 2026] [:error] [pid 63311:tid 63374] [client 20.240.142.13:29053] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file61.php"] [unique_id "ad0IL6HjrGN1MqBCVFksHwAAAIM"]
[Mon Apr 13 23:13:52.312447 2026] [:error] [pid 63406:tid 63430] [client 20.240.142.13:21044] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file61.php"] [unique_id "ad0IMLHZEIkQ0Zmgp5odKAAAANM"]
[Mon Apr 13 23:13:53.336674 2026] [:error] [pid 57183:tid 57202] [client 20.240.142.13:46886] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file61.php"] [unique_id "ad0IMTDO3t8R5NaxzYSRhAAAAVE"]
[Mon Apr 13 23:13:54.066508 2026] [:error] [pid 57183:tid 57199] [client 20.240.142.13:21048] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/file61.php"] [unique_id "ad0IMjDO3t8R5NaxzYSRjAAAAU4"]
[Mon Apr 13 23:13:54.738165 2026] [:error] [pid 57183:tid 57189] [client 20.240.142.13:45010] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/uuu.php"] [unique_id "ad0IMjDO3t8R5NaxzYSRkAAAAUQ"]
[Mon Apr 13 23:13:55.489950 2026] [:error] [pid 9314:tid 9337] [client 20.240.142.13:21033] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/uuu.php"] [unique_id "ad0IM2_r4W8fX2GWyGRaugAAAZU"]
[Mon Apr 13 23:13:56.337904 2026] [:error] [pid 63309:tid 63334] [client 20.240.142.13:26020] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/uuu.php"] [unique_id "ad0INEpIKZ10weXpf0VEFQAAABU"]
[Mon Apr 13 23:13:57.044660 2026] [:error] [pid 9314:tid 9330] [client 20.240.142.13:11570] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/uuu.php"] [unique_id "ad0INW_r4W8fX2GWyGRavgAAAY4"]
[Mon Apr 13 23:13:57.750903 2026] [:error] [pid 57183:tid 57202] [client 20.240.142.13:27287] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gptsh.php"] [unique_id "ad0INTDO3t8R5NaxzYSRpgAAAVE"]
[Mon Apr 13 23:13:58.421531 2026] [:error] [pid 9314:tid 9326] [client 20.240.142.13:45032] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gptsh.php"] [unique_id "ad0INm_r4W8fX2GWyGRawAAAAYo"]
[Mon Apr 13 23:13:59.342132 2026] [:error] [pid 63406:tid 63432] [client 20.240.142.13:43855] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gptsh.php"] [unique_id "ad0IN7HZEIkQ0Zmgp5odNwAAANU"]
[Mon Apr 13 23:14:00.829968 2026] [:error] [pid 57183:tid 57209] [client 20.240.142.13:14711] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/gptsh.php"] [unique_id "ad0IODDO3t8R5NaxzYSRsQAAAVg"]
[Mon Apr 13 23:14:03.456826 2026] [:error] [pid 63309:tid 63332] [client 20.240.142.13:30632] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ad0IO0pIKZ10weXpf0VEHAAAABM"]
[Mon Apr 13 23:14:06.825331 2026] [:error] [pid 63311:tid 63377] [client 20.240.142.13:35570] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ad0IPqHjrGN1MqBCVFksJwAAAIY"]
[Mon Apr 13 23:14:11.243810 2026] [:error] [pid 9314:tid 9321] [client 20.240.142.13:41651] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ad0IQ2_r4W8fX2GWyGRa4gAAAYU"]
[Mon Apr 13 23:14:12.532510 2026] [:error] [pid 57183:tid 57188] [client 20.240.142.13:19185] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/mI35rZhMg1zJ1vuXdefault.php"] [unique_id "ad0IRDDO3t8R5NaxzYSRxgAAAUM"]
[Mon Apr 13 23:14:13.324078 2026] [:error] [pid 63406:tid 63421] [client 20.240.142.13:43859] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sid3.php"] [unique_id "ad0IRbHZEIkQ0Zmgp5odawAAAMo"]
[Mon Apr 13 23:14:14.728754 2026] [:error] [pid 9314:tid 9333] [client 20.240.142.13:21707] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sid3.php"] [unique_id "ad0IRm_r4W8fX2GWyGRa6AAAAZE"]
[Mon Apr 13 23:14:15.663993 2026] [:error] [pid 57183:tid 57208] [client 20.240.142.13:35580] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sid3.php"] [unique_id "ad0IRzDO3t8R5NaxzYSR1AAAAVc"]
[Mon Apr 13 23:14:16.777757 2026] [:error] [pid 57183:tid 57185] [client 20.240.142.13:43863] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sid3.php"] [unique_id "ad0ISDDO3t8R5NaxzYSR3gAAAUA"]
[Mon Apr 13 23:14:26.602396 2026] [:error] [pid 63309:tid 63314] [client 20.240.142.13:37008] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "ad0IUkpIKZ10weXpf0VEKwAAAAE"]
[Mon Apr 13 23:14:27.715391 2026] [:error] [pid 63406:tid 63425] [client 20.240.142.13:35556] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "ad0IU7HZEIkQ0Zmgp5oduwAAAM4"]
[Mon Apr 13 23:14:28.975419 2026] [:error] [pid 63406:tid 63412] [client 20.240.142.13:1767] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "ad0IVLHZEIkQ0Zmgp5odwQAAAME"]
[Mon Apr 13 23:14:30.322929 2026] [:error] [pid 63309:tid 63321] [client 20.240.142.13:1584] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/torsa1.php"] [unique_id "ad0IVkpIKZ10weXpf0VELgAAAAg"]
[Mon Apr 13 23:14:32.072593 2026] [:error] [pid 63310:tid 63364] [client 20.240.142.13:43877] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sadcut1.php"] [unique_id "ad0IWHoXpRU5ztmwPjJ7IQAAAFQ"]
[Mon Apr 13 23:14:34.206008 2026] [:error] [pid 63309:tid 63315] [client 20.240.142.13:1784] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sadcut1.php"] [unique_id "ad0IWkpIKZ10weXpf0VEMwAAAAI"]
[Mon Apr 13 23:14:36.230514 2026] [:error] [pid 63310:tid 63344] [client 20.240.142.13:1732] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sadcut1.php"] [unique_id "ad0IXHoXpRU5ztmwPjJ7JwAAAEA"]
[Mon Apr 13 23:14:37.892279 2026] [:error] [pid 63309:tid 63333] [client 20.240.142.13:21650] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/sadcut1.php"] [unique_id "ad0IXUpIKZ10weXpf0VENgAAABQ"]
[Mon Apr 13 23:14:39.262613 2026] [:error] [pid 63406:tid 63412] [client 20.240.142.13:1237] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/zoper1.php"] [unique_id "ad0IX7HZEIkQ0Zmgp5od3wAAAME"]
[Mon Apr 13 23:14:40.490395 2026] [:error] [pid 63406:tid 63434] [client 20.240.142.13:45971] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/zoper1.php"] [unique_id "ad0IYLHZEIkQ0Zmgp5od6QAAANc"]
[Mon Apr 13 23:14:41.185657 2026] [:error] [pid 9314:tid 9339] [client 20.240.142.13:1779] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/zoper1.php"] [unique_id "ad0IYW_r4W8fX2GWyGRbIgAAAZc"]
[Mon Apr 13 23:14:42.111139 2026] [:error] [pid 63311:tid 63378] [client 20.240.142.13:45075] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/zoper1.php"] [unique_id "ad0IYqHjrGN1MqBCVFksTwAAAIc"]
[Mon Apr 13 23:14:42.893506 2026] [:error] [pid 63406:tid 63424] [client 20.240.142.13:33155] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ortasekerli1.php"] [unique_id "ad0IYrHZEIkQ0Zmgp5oeBgAAAM0"]
[Mon Apr 13 23:14:43.721175 2026] [:error] [pid 63311:tid 63386] [client 20.240.142.13:40079] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ortasekerli1.php"] [unique_id "ad0IY6HjrGN1MqBCVFksUwAAAI8"]
[Mon Apr 13 23:14:45.540643 2026] [:error] [pid 63309:tid 63314] [client 20.240.142.13:41570] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ortasekerli1.php"] [unique_id "ad0IZUpIKZ10weXpf0VEPAAAAAE"]
[Mon Apr 13 23:14:46.923696 2026] [:error] [pid 63311:tid 63395] [client 20.240.142.13:33195] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/ortasekerli1.php"] [unique_id "ad0IZqHjrGN1MqBCVFksVQAAAJg"]
[Mon Apr 13 23:14:47.725868 2026] [:error] [pid 63309:tid 63337] [client 20.240.142.13:48638] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-good.php"] [unique_id "ad0IZ0pIKZ10weXpf0VEPgAAABg"]
[Mon Apr 13 23:14:48.537814 2026] [:error] [pid 63309:tid 63321] [client 20.240.142.13:45470] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-good.php"] [unique_id "ad0IaEpIKZ10weXpf0VEQgAAAAg"]
[Mon Apr 13 23:14:49.466299 2026] [:error] [pid 57183:tid 57194] [client 20.240.142.13:40713] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-good.php"] [unique_id "ad0IaTDO3t8R5NaxzYSR-QAAAUk"]
[Mon Apr 13 23:14:50.366988 2026] [:error] [pid 63406:tid 63412] [client 20.240.142.13:27918] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wp-good.php"] [unique_id "ad0IarHZEIkQ0Zmgp5oeewAAAME"]
[Mon Apr 13 23:14:50.938594 2026] [:error] [pid 7228:tid 7245] [client 20.240.142.13:39030] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wmore1.php"] [unique_id "ad0IagEnn1dQrOSHHNXJfQAAAQ8"]
[Mon Apr 13 23:14:51.726723 2026] [:error] [pid 57183:tid 57185] [client 20.240.142.13:43511] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wmore1.php"] [unique_id "ad0IazDO3t8R5NaxzYSR_wAAAUA"]
[Mon Apr 13 23:14:52.492560 2026] [:error] [pid 57183:tid 57188] [client 20.240.142.13:38979] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wmore1.php"] [unique_id "ad0IbDDO3t8R5NaxzYSSAAAAAUM"]
[Mon Apr 13 23:14:53.312020 2026] [:error] [pid 63406:tid 63426] [client 20.240.142.13:11953] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/wmore1.php"] [unique_id "ad0IbbHZEIkQ0Zmgp5oeiQAAAM8"]
[Mon Apr 13 23:14:54.389361 2026] [:error] [pid 63309:tid 63313] [client 20.240.142.13:24730] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/new3.php"] [unique_id "ad0IbkpIKZ10weXpf0VERAAAAAA"]
[Mon Apr 13 23:14:55.897692 2026] [:error] [pid 63406:tid 63427] [client 20.240.142.13:23596] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/new3.php"] [unique_id "ad0Ib7HZEIkQ0Zmgp5oelgAAANA"]
[Mon Apr 13 23:14:58.772611 2026] [:error] [pid 7228:tid 7232] [client 20.240.142.13:37057] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/new3.php"] [unique_id "ad0IcgEnn1dQrOSHHNXJiAAAAQI"]
[Mon Apr 13 23:15:00.283948 2026] [:error] [pid 57183:tid 57208] [client 20.240.142.13:37096] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/new3.php"] [unique_id "ad0IdDDO3t8R5NaxzYSSDwAAAVc"]
[Mon Apr 13 23:15:01.392947 2026] [:error] [pid 57183:tid 57185] [client 20.240.142.13:23554] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nw.php"] [unique_id "ad0IdTDO3t8R5NaxzYSSGwAAAUA"]
[Mon Apr 13 23:15:02.396377 2026] [:error] [pid 9314:tid 9325] [client 20.240.142.13:23570] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nw.php"] [unique_id "ad0Idm_r4W8fX2GWyGRbSgAAAYk"]
[Mon Apr 13 23:15:03.326812 2026] [:error] [pid 63406:tid 63414] [client 20.240.142.13:11964] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nw.php"] [unique_id "ad0Id7HZEIkQ0Zmgp5oerQAAAMM"]
[Mon Apr 13 23:15:04.794655 2026] [:error] [pid 57183:tid 57203] [client 20.240.142.13:27962] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/nw.php"] [unique_id "ad0IeDDO3t8R5NaxzYSSJAAAAVI"]
[Mon Apr 13 23:15:06.154098 2026] [:error] [pid 9314:tid 9335] [client 20.240.142.13:43463] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/byypas.php"] [unique_id "ad0Iem_r4W8fX2GWyGRbWwAAAZM"]
[Mon Apr 13 23:15:07.105792 2026] [:error] [pid 63310:tid 63360] [client 20.240.142.13:24757] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/byypas.php"] [unique_id "ad0Ie3oXpRU5ztmwPjJ7RwAAAFA"]
[Mon Apr 13 23:15:08.297804 2026] [:error] [pid 9314:tid 9320] [client 20.240.142.13:39023] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/byypas.php"] [unique_id "ad0IfG_r4W8fX2GWyGRbZgAAAYQ"]
[Mon Apr 13 23:15:09.569670 2026] [:error] [pid 63406:tid 63418] [client 20.240.142.13:24755] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/byypas.php"] [unique_id "ad0IfbHZEIkQ0Zmgp5oetAAAAMc"]
[Mon Apr 13 23:15:10.209016 2026] [:error] [pid 9314:tid 9324] [client 20.240.142.13:14245] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/rithin.php"] [unique_id "ad0Ifm_r4W8fX2GWyGRbbQAAAYg"]
[Mon Apr 13 23:15:10.767341 2026] [:error] [pid 9314:tid 9320] [client 20.240.142.13:39022] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/rithin.php"] [unique_id "ad0Ifm_r4W8fX2GWyGRbcAAAAYQ"]
[Mon Apr 13 23:15:11.822205 2026] [:error] [pid 63406:tid 63427] [client 20.240.142.13:20612] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/rithin.php"] [unique_id "ad0If7HZEIkQ0Zmgp5oeuAAAANA"]
[Mon Apr 13 23:15:13.302401 2026] [:error] [pid 9314:tid 9338] [client 20.240.142.13:14208] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/rithin.php"] [unique_id "ad0IgW_r4W8fX2GWyGRbeQAAAZY"]
[Mon Apr 13 23:15:14.619397 2026] [:error] [pid 7228:tid 7241] [client 20.240.142.13:25484] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a4.php"] [unique_id "ad0IggEnn1dQrOSHHNXJmwAAAQs"]
[Mon Apr 13 23:15:15.728835 2026] [:error] [pid 63311:tid 63384] [client 20.240.142.13:37653] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a4.php"] [unique_id "ad0Ig6HjrGN1MqBCVFkseQAAAI0"]
[Mon Apr 13 23:15:17.146838 2026] [:error] [pid 57183:tid 57191] [client 20.240.142.13:1668] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a4.php"] [unique_id "ad0IhTDO3t8R5NaxzYSSOwAAAUY"]
[Mon Apr 13 23:15:18.507899 2026] [:error] [pid 7228:tid 7247] [client 20.240.142.13:1707] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/a4.php"] [unique_id "ad0IhgEnn1dQrOSHHNXJoAAAARE"]
[Mon Apr 13 23:15:19.356816 2026] [:error] [pid 57183:tid 57190] [client 20.240.142.13:43466] [client 20.240.142.13] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "www.paramountestate.com.au"] [uri "/jlex.php"] [unique_id "ad0IhzDO3t8R5NaxzYSSRwAAAUU"]
[Tue Apr 14 00:55:04.797986 2026] [:error] [pid 59913:tid 59921] [client 115.84.115.161:6153] [client 115.84.115.161] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 115.84.115.161, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ad0f6K5XvQ9C-gZtr2yaVQAAAAQ"]
[Tue Apr 14 06:19:46.241656 2026] [:error] [pid 64393:tid 64406] [client 159.89.53.247:43834] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "ad1sAuClKltJhW50hKPlfgAAAQs"]
[Tue Apr 14 06:19:50.888973 2026] [:error] [pid 64393:tid 64406] [client 159.89.53.247:41496] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "ad1sBuClKltJhW50hKPlnAAAAQs"]
[Tue Apr 14 06:43:03.425307 2026] [:error] [pid 35629:tid 35669] [client 216.73.216.115:4843] [client 216.73.216.115] ModSecurity: Warning. Pattern match "^$" at REQUEST_HEADERS:user-agent. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "120"] [id "217240"] [rev "3"] [msg "COMODO WAF: Empty User Agent Header||paramountestate.com.au|F|5"] [data "REQUEST_HEADERS:user-agent="] [severity "NOTICE"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/robots.txt"] [unique_id "ad1xdzY8VahzC1YJBSih2wAAAEo"]
[Tue Apr 14 08:27:48.122262 2026] [:error] [pid 35713:tid 35734] [client 159.89.53.247:51812] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "ad2KBK6-hhx6ZepqOSnHHwAAANI"]
[Tue Apr 14 08:27:52.390404 2026] [:error] [pid 35713:tid 35727] [client 159.89.53.247:55244] [client 159.89.53.247] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "ad2KCK6-hhx6ZepqOSnHKgAAAMs"]
[Tue Apr 14 23:47:55.643960 2026] [:error] [pid 60074:tid 60093] [client 51.103.118.101:12884] [client 51.103.118.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "ad5hq-tqnEmNU9vpHCnangAAANE"]
[Tue Apr 14 23:48:04.951866 2026] [:error] [pid 59987:tid 60067] [client 51.103.118.101:12880] [client 51.103.118.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.paramountestate.com.au"] [uri "/tiny.php"] [unique_id "ad5htFWpk-Tfi6_vLKpcBQAAAJQ"]
[Tue Apr 14 23:48:41.622772 2026] [:error] [pid 60074:tid 60087] [client 51.103.118.101:12874] [client 51.103.118.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/wincust.php"] [unique_id "ad5h2etqnEmNU9vpHCnbWwAAAMs"]
[Tue Apr 14 23:49:17.928937 2026] [:error] [pid 3810:tid 3835] [client 20.107.203.74:59267] [client 20.107.203.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ad5h_cqc5XaYZhFXVGfoIQAAAZY"]
[Wed Apr 15 01:20:24.990842 2026] [:error] [pid 62297:tid 62361] [client 216.81.248.211:55586] [client 216.81.248.211] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "ad53WKvogcWlrafOEaHHVgAAAQc"]
[Wed Apr 15 11:14:09.930541 2026] [:error] [pid 30555:tid 30638] [client 103.237.39.208:55778] [client 103.237.39.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.237.39.208, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ad8CgVTZEITMpQMsOnjSNgAAAJg"]
[Wed Apr 15 13:40:49.736300 2026] [proxy_fcgi:error] [pid 11385:tid 11450] [client 20.151.224.247:10405] AH01071: Got error 'Primary script unknown'
[Wed Apr 15 13:41:27.151318 2026] [:error] [pid 11385:tid 11466] [client 20.151.224.247:10405] [client 20.151.224.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/Requests/abou.php"] [unique_id "ad8lBx_mZoXMMCiUoKUW8AAAANE"]
[Wed Apr 15 13:41:28.086410 2026] [:error] [pid 12433:tid 12438] [client 20.151.224.247:4855] [client 20.151.224.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/ioxi-o.php"] [unique_id "ad8lCLwxDHWF005pP_5mCAAAAQM"]
[Wed Apr 15 13:41:34.469056 2026] [:error] [pid 12433:tid 12440] [client 20.151.224.247:9445] [client 20.151.224.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "ad8lDrwxDHWF005pP_5mNgAAAQU"]
[Wed Apr 15 13:41:35.449147 2026] [:error] [pid 12396:tid 12400] [client 20.151.224.247:8868] [client 20.151.224.247] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.151.224.247, incrementing ddos counter"] [hostname "www.paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ad8lD8CQWGYUWgxc5kjTMAAAAII"]
[Wed Apr 15 13:41:54.626168 2026] [:error] [pid 12396:tid 12405] [client 20.151.224.247:8868] [client 20.151.224.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/block-patterns/admin.php"] [unique_id "ad8lIsCQWGYUWgxc5kjTfQAAAIc"]
[Thu Apr 16 01:04:43.163662 2026] [:error] [pid 30958:tid 31032] [client 189.135.223.140:55022] [client 189.135.223.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.135.223.140, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ad_FK8eG3wSKTO7NWFEOdwAAANA"]
[Thu Apr 16 01:53:15.696478 2026] [ssl:error] [pid 54814:tid 54833] [client 143.244.47.83:20892] AH02032: Hostname www.google.com provided via SNI and hostname paramountestate.com.au provided via HTTP have no compatible SSL setup
[Thu Apr 16 02:43:15.872799 2026] [:error] [pid 791:tid 842] [client 91.200.101.138:50102] [client 91.200.101.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/graphql"] [unique_id "ad_cQ7xl5Y18om2fepnhXQAAAEI"]
[Thu Apr 16 07:58:59.185006 2026] [:error] [pid 29603:tid 29612] [client 20.203.253.182:64158] [client 20.203.253.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "aeAmQ1fGOR6fpTWUAzrtXwAAAQc"]
[Thu Apr 16 12:34:18.023091 2026] [:error] [pid 7880:tid 7906] [client 98.93.160.221:45752] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "aeBmyqaezm4fSGc0yUIYqAAAAZU"]
[Thu Apr 16 14:01:50.686640 2026] [:error] [pid 29603:tid 29605] [client 98.93.160.221:60230] [client 98.93.160.221] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aeB7TlfGOR6fpTWUAzo-XAAAAQA"]
[Thu Apr 16 19:19:40.961349 2026] [:error] [pid 49094:tid 49096] [client 158.158.35.197:30669] [client 158.158.35.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeDFzDbDwvcXorHR_MyW-wAAAUA"]
[Thu Apr 16 19:19:51.651753 2026] [:error] [pid 57536:tid 57562] [client 158.158.35.197:27286] [client 158.158.35.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "aeDF1yQU4faGja6jpDtJAQAAAA4"]
[Thu Apr 16 19:20:35.837537 2026] [:error] [pid 57639:tid 57669] [client 158.158.35.197:30715] [client 158.158.35.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wincust.php"] [unique_id "aeDGA6MCQoTw7TsxWulGQQAAANc"]
[Thu Apr 16 21:26:04.305142 2026] [:error] [pid 49094:tid 49102] [client 170.64.154.41:52014] [client 170.64.154.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.154.41, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aeDjbDbDwvcXorHR_MzlogAAAUY"]
[Thu Apr 16 21:26:04.379473 2026] [:error] [pid 49094:tid 49110] [client 170.64.154.41:52017] [client 170.64.154.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 170.64.154.41, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aeDjbDbDwvcXorHR_MzlpAAAAU4"]
[Thu Apr 16 21:41:12.584657 2026] [:error] [pid 57639:tid 57660] [client 158.158.73.200:60574] [client 158.158.73.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeDm-KMCQoTw7TsxWum_SAAAAM4"]
[Fri Apr 17 00:30:11.299136 2026] [:error] [pid 43385:tid 43398] [client 45.130.203.159:60771] [client 45.130.203.159] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "aeEOk8nIxkJaUI8KNs7xrwAAAAk"]
[Fri Apr 17 00:30:12.077098 2026] [:error] [pid 43482:tid 43494] [client 45.130.203.137:38437] [client 45.130.203.137] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "aeEOlD9SZnuKxlHrct156AAAAMo"]
[Fri Apr 17 06:57:43.475593 2026] [:error] [pid 9152:tid 9205] [client 20.100.190.76:26814] [client 20.100.190.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "aeFpZ5JYca8I3TNCwIc7vAAAAE8"]
[Fri Apr 17 07:03:57.043907 2026] [:error] [pid 25010:tid 25020] [client 136.117.100.166:35058] [client 136.117.100.166] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/server/.env"] [unique_id "aeFq3Y-7kkf42RarqQ3eRAAAAUc"]
[Fri Apr 17 20:27:15.854733 2026] [:error] [pid 9152:tid 9205] [client 51.103.162.82:63412] [client 51.103.162.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeInI5JYca8I3TNCwIdWhgAAAE8"]
[Sat Apr 18 05:51:49.692381 2026] [:error] [pid 9970:tid 9983] [client 74.248.150.204:61973] [client 74.248.150.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeKrdSYdRLRhVmaIMx3F6AAAAMk"]
[Sat Apr 18 08:22:25.776849 2026] [:error] [pid 34237:tid 34256] [client 4.235.105.111:8160] [client 4.235.105.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aeLOwRBmX4Wq5a6rxfbkWAAAAVE"]
[Sat Apr 18 08:34:00.401802 2026] [ssl:error] [pid 34237:tid 34246] [client 23.159.216.28:54094] AH02032: Hostname paramountbaldivis.com.au provided via SNI and hostname paramountestate.com.au provided via HTTP have no compatible SSL setup, referer: http://paramountestate.com.au/
[Sat Apr 18 10:21:19.434610 2026] [:error] [pid 34237:tid 34256] [client 4.235.108.154:16707] [client 4.235.108.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeLqnxBmX4Wq5a6rxfYVdAAAAVE"]
[Sat Apr 18 10:21:29.343628 2026] [:error] [pid 34237:tid 34250] [client 4.235.108.154:19132] [client 4.235.108.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "aeLqqRBmX4Wq5a6rxfYViQAAAUs"]
[Sat Apr 18 10:22:06.799886 2026] [:error] [pid 9970:tid 9988] [client 4.235.108.154:19120] [client 4.235.108.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wincust.php"] [unique_id "aeLqziYdRLRhVmaIMx0pSwAAAM4"]
[Sat Apr 18 14:20:11.663624 2026] [:error] [pid 9864:tid 9912] [client 194.61.40.125:64863] [client 194.61.40.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aeMim4CFeowknfXHM7mumQAAAEY"]
[Sat Apr 18 14:20:12.589117 2026] [:error] [pid 34290:tid 34340] [client 194.61.40.166:32201] [client 194.61.40.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aeMinBqX6WpmmAXOBi--PgAAAdU"]
[Sat Apr 18 14:20:14.072932 2026] [:error] [pid 13023:tid 13048] [client 194.61.40.129:65063] [client 194.61.40.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aeMinv1e7hG8DAeABB--6AAAARc"]
[Sat Apr 18 14:20:15.993138 2026] [:error] [pid 9864:tid 9930] [client 194.61.40.126:52653] [client 194.61.40.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aeMin4CFeowknfXHM7mupQAAAFg"]
[Sat Apr 18 14:20:17.467248 2026] [:error] [pid 9865:tid 9956] [client 194.61.40.144:27999] [client 194.61.40.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aeMioazb5knECIY-C-g1VwAAAJM"]
[Sat Apr 18 14:20:18.031544 2026] [:error] [pid 9865:tid 9955] [client 194.61.40.133:22721] [client 194.61.40.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aeMioqzb5knECIY-C-g1XwAAAJI"]
[Sat Apr 18 14:20:18.405195 2026] [:error] [pid 34290:tid 34330] [client 194.61.40.135:44769] [client 194.61.40.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aeMiohqX6WpmmAXOBi--XwAAAcs"]
[Sat Apr 18 14:20:18.770128 2026] [:error] [pid 34290:tid 34334] [client 194.61.40.162:39699] [client 194.61.40.162] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aeMiohqX6WpmmAXOBi--YQAAAc8"]
[Sat Apr 18 14:20:19.149002 2026] [:error] [pid 34288:tid 34310] [client 194.61.40.144:50555] [client 194.61.40.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aeMio-TIiy__PtiLmpmiDAAAAZI"]
[Sat Apr 18 14:20:19.512282 2026] [:error] [pid 9970:tid 9974] [client 194.61.40.141:65091] [client 194.61.40.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aeMioyYdRLRhVmaIMx1mugAAAMA"]
[Sat Apr 18 14:20:20.063511 2026] [:error] [pid 9970:tid 9979] [client 194.61.40.133:38001] [client 194.61.40.133] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aeMipCYdRLRhVmaIMx1mvQAAAMU"]
[Sat Apr 18 14:20:20.795053 2026] [:error] [pid 9864:tid 9924] [client 194.61.40.141:33335] [client 194.61.40.141] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "aeMipICFeowknfXHM7mutwAAAFI"]
[Sat Apr 18 14:20:21.535784 2026] [:error] [pid 9865:tid 9938] [client 194.61.40.138:22589] [client 194.61.40.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aeMipazb5knECIY-C-g1ZwAAAIE"]
[Sat Apr 18 14:20:22.085358 2026] [:error] [pid 34290:tid 34336] [client 194.61.40.148:49957] [client 194.61.40.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "aeMiphqX6WpmmAXOBi--aQAAAdE"]
[Sat Apr 18 14:20:22.642988 2026] [:error] [pid 9865:tid 9950] [client 194.61.40.144:45845] [client 194.61.40.144] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aeMipqzb5knECIY-C-g1aQAAAI0"]
[Sat Apr 18 14:20:24.117431 2026] [:error] [pid 9865:tid 9956] [client 194.61.40.130:41385] [client 194.61.40.130] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aeMiqKzb5knECIY-C-g1cAAAAJM"]
[Sat Apr 18 14:20:26.272978 2026] [:error] [pid 9864:tid 9907] [client 194.61.40.128:48391] [client 194.61.40.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "aeMiqoCFeowknfXHM7muxgAAAEI"]
[Sat Apr 18 14:20:27.006410 2026] [:error] [pid 9865:tid 9944] [client 194.61.40.154:58357] [client 194.61.40.154] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "aeMiq6zb5knECIY-C-g1dwAAAIc"]
[Sat Apr 18 14:20:27.553282 2026] [:error] [pid 9865:tid 9951] [client 194.61.40.147:34839] [client 194.61.40.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aeMiq6zb5knECIY-C-g1ewAAAI4"]
[Sat Apr 18 14:20:28.659693 2026] [:error] [pid 9864:tid 9924] [client 194.61.40.156:39379] [client 194.61.40.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aeMirICFeowknfXHM7mu0AAAAFI"]
[Sat Apr 18 14:20:29.222550 2026] [:error] [pid 9970:tid 9994] [client 194.61.40.112:21725] [client 194.61.40.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "aeMirSYdRLRhVmaIMx1mwgAAANQ"]
[Sat Apr 18 14:20:29.777252 2026] [:error] [pid 9865:tid 9942] [client 194.61.40.138:58053] [client 194.61.40.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "aeMirazb5knECIY-C-g1gAAAAIU"]
[Sat Apr 18 14:20:30.139625 2026] [:error] [pid 13023:tid 13030] [client 194.61.40.140:33059] [client 194.61.40.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "aeMirv1e7hG8DAeABB--7AAAAQU"]
[Sat Apr 18 14:20:30.503090 2026] [:error] [pid 9864:tid 9929] [client 194.61.40.113:41575] [client 194.61.40.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aeMiroCFeowknfXHM7mu1QAAAFc"]
[Sat Apr 18 14:20:31.469982 2026] [:error] [pid 9864:tid 9912] [client 194.61.40.128:23927] [client 194.61.40.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "aeMir4CFeowknfXHM7mu3AAAAEY"]
[Sat Apr 18 14:20:31.832155 2026] [:error] [pid 34288:tid 34316] [client 194.61.40.137:42981] [client 194.61.40.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "aeMir-TIiy__PtiLmpmiGAAAAZg"]
[Sat Apr 18 14:20:32.195563 2026] [:error] [pid 9865:tid 9950] [client 194.61.40.153:62347] [client 194.61.40.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aeMisKzb5knECIY-C-g1gwAAAI0"]
[Sat Apr 18 14:20:34.040438 2026] [:error] [pid 34288:tid 34313] [client 194.61.40.137:36765] [client 194.61.40.137] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/admin.php"] [unique_id "aeMisuTIiy__PtiLmpmiIwAAAZU"]
[Sat Apr 18 14:20:34.963345 2026] [:error] [pid 9865:tid 9949] [client 194.61.40.135:27271] [client 194.61.40.135] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.61.40.135, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "aeMisqzb5knECIY-C-g1jQAAAIw"]
[Sat Apr 18 14:20:37.206695 2026] [:error] [pid 9865:tid 9942] [client 194.61.40.135:27271] [client 194.61.40.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aeMitazb5knECIY-C-g1nwAAAIU"]
[Sat Apr 18 14:20:37.938786 2026] [:error] [pid 13023:tid 13042] [client 194.61.40.115:29917] [client 194.61.40.115] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.61.40.115, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "aeMitf1e7hG8DAeABB-_AAAAARE"]
[Sat Apr 18 14:20:38.311828 2026] [:error] [pid 13023:tid 13026] [client 194.61.40.115:29917] [client 194.61.40.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/item.php"] [unique_id "aeMitv1e7hG8DAeABB-_AgAAAQE"]
[Sat Apr 18 14:20:40.174340 2026] [:error] [pid 9970:tid 9989] [client 194.61.40.135:36855] [client 194.61.40.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "aeMiuCYdRLRhVmaIMx1m3wAAAM8"]
[Sat Apr 18 14:20:42.023771 2026] [:error] [pid 9970:tid 9993] [client 194.61.40.161:65487] [client 194.61.40.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aeMiuiYdRLRhVmaIMx1m6wAAANM"]
[Sat Apr 18 14:20:42.753437 2026] [:error] [pid 9864:tid 9910] [client 194.61.40.123:52999] [client 194.61.40.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "aeMiuoCFeowknfXHM7mu7wAAAEU"]
[Sat Apr 18 14:20:43.674008 2026] [:error] [pid 13023:tid 13034] [client 194.61.40.147:59411] [client 194.61.40.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.61.40.147, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aeMiu_1e7hG8DAeABB-_DAAAAQk"]
[Sat Apr 18 14:20:43.857995 2026] [:error] [pid 13023:tid 13028] [client 194.61.40.147:59411] [client 194.61.40.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "aeMiu_1e7hG8DAeABB-_DgAAAQM"]
[Sat Apr 18 14:20:47.381459 2026] [:error] [pid 9864:tid 9928] [client 194.61.40.128:40703] [client 194.61.40.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "aeMiv4CFeowknfXHM7mvDgAAAFY"]
[Sat Apr 18 14:20:48.308955 2026] [:error] [pid 9863:tid 9894] [client 194.61.40.157:33575] [client 194.61.40.157] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 194.61.40.157, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "aeMiwDjjiypiFrTucbKdygAAABU"]
[Sat Apr 18 14:20:49.053918 2026] [:error] [pid 9863:tid 9879] [client 194.61.40.157:33575] [client 194.61.40.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "aeMiwTjjiypiFrTucbKd0gAAAAY"]
[Sat Apr 18 14:20:49.601815 2026] [:error] [pid 34288:tid 34303] [client 194.61.40.140:63803] [client 194.61.40.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/infi.php"] [unique_id "aeMiweTIiy__PtiLmpmiOAAAAYs"]
[Sat Apr 18 14:20:50.330907 2026] [:error] [pid 13023:tid 13036] [client 194.61.40.146:58847] [client 194.61.40.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aeMiwv1e7hG8DAeABB-_FQAAAQs"]
[Sat Apr 18 14:20:51.246877 2026] [:error] [pid 34290:tid 34329] [client 194.61.40.158:42665] [client 194.61.40.158] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aeMiwxqX6WpmmAXOBi--hgAAAco"]
[Sat Apr 18 14:20:51.611657 2026] [:error] [pid 9864:tid 9917] [client 194.61.40.118:32133] [client 194.61.40.118] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "aeMiw4CFeowknfXHM7mvEgAAAEs"]
[Sat Apr 18 14:20:52.908015 2026] [:error] [pid 9864:tid 9929] [client 194.61.40.112:22255] [client 194.61.40.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aeMixICFeowknfXHM7mvGwAAAFc"]
[Sat Apr 18 14:20:53.456043 2026] [:error] [pid 34237:tid 34244] [client 194.61.40.121:41687] [client 194.61.40.121] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "aeMixRBmX4Wq5a6rxfYz_gAAAUU"]
[Sat Apr 18 14:20:54.374740 2026] [:error] [pid 9865:tid 9954] [client 194.61.40.152:47933] [client 194.61.40.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/edit.php"] [unique_id "aeMixqzb5knECIY-C-g1rAAAAJE"]
[Sat Apr 18 14:20:55.296390 2026] [:error] [pid 9865:tid 9952] [client 194.61.40.123:24067] [client 194.61.40.123] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "aeMix6zb5knECIY-C-g1sQAAAI8"]
[Sat Apr 18 14:20:56.034503 2026] [:error] [pid 34290:tid 34334] [client 194.61.40.135:47257] [client 194.61.40.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/click.php"] [unique_id "aeMiyBqX6WpmmAXOBi--kwAAAc8"]
[Sat Apr 18 14:20:56.951008 2026] [:error] [pid 34290:tid 34327] [client 194.61.40.122:59931] [client 194.61.40.122] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "aeMiyBqX6WpmmAXOBi--mgAAAcg"]
[Sat Apr 18 14:20:58.620649 2026] [:error] [pid 34290:tid 34333] [client 194.61.40.117:55299] [client 194.61.40.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "aeMiyhqX6WpmmAXOBi--pwAAAc4"]
[Sat Apr 18 14:20:58.984337 2026] [:error] [pid 34290:tid 34336] [client 194.61.40.110:60993] [client 194.61.40.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "aeMiyhqX6WpmmAXOBi--rAAAAdE"]
[Sat Apr 18 14:20:59.351808 2026] [:error] [pid 9863:tid 9882] [client 194.61.40.150:52559] [client 194.61.40.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "aeMiyzjjiypiFrTucbKd4QAAAAk"]
[Sat Apr 18 14:20:59.714736 2026] [:error] [pid 34290:tid 34328] [client 194.61.40.110:64225] [client 194.61.40.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "aeMiyxqX6WpmmAXOBi--sQAAAck"]
[Sat Apr 18 14:21:00.272561 2026] [:error] [pid 34290:tid 34323] [client 194.61.40.112:32399] [client 194.61.40.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "aeMizBqX6WpmmAXOBi--tAAAAcQ"]
[Sat Apr 18 14:21:00.769119 2026] [:error] [pid 34290:tid 34333] [client 194.61.40.148:61793] [client 194.61.40.148] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "aeMizBqX6WpmmAXOBi--uAAAAc4"]
[Sat Apr 18 14:21:01.507695 2026] [:error] [pid 34237:tid 34242] [client 194.61.40.132:64441] [client 194.61.40.132] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aeMizRBmX4Wq5a6rxfY0FwAAAUM"]
[Sat Apr 18 14:21:01.871218 2026] [:error] [pid 9864:tid 9918] [client 194.61.40.116:48937] [client 194.61.40.116] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "aeMizYCFeowknfXHM7mvLwAAAEw"]
[Sat Apr 18 14:21:02.234889 2026] [:error] [pid 9970:tid 9998] [client 194.61.40.117:60481] [client 194.61.40.117] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "aeMiziYdRLRhVmaIMx1nAQAAANg"]
[Sat Apr 18 14:21:02.598446 2026] [:error] [pid 9865:tid 9952] [client 194.61.40.163:23151] [client 194.61.40.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "aeMizqzb5knECIY-C-g1vQAAAI8"]
[Sat Apr 18 14:21:03.146022 2026] [:error] [pid 9864:tid 9924] [client 194.61.40.161:63415] [client 194.61.40.161] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aeMiz4CFeowknfXHM7mvMwAAAFI"]
[Sat Apr 18 14:21:03.878554 2026] [:error] [pid 34290:tid 34327] [client 194.61.40.111:24987] [client 194.61.40.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "aeMizxqX6WpmmAXOBi--_AAAAcg"]
[Sat Apr 18 14:21:04.978987 2026] [:error] [pid 9864:tid 9924] [client 194.61.40.157:46395] [client 194.61.40.157] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "aeMi0ICFeowknfXHM7mvPgAAAFI"]
[Sat Apr 18 14:21:06.631940 2026] [:error] [pid 9864:tid 9921] [client 194.61.40.135:28639] [client 194.61.40.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "aeMi0oCFeowknfXHM7mvSwAAAE8"]
[Sat Apr 18 14:21:07.550780 2026] [:error] [pid 9864:tid 9923] [client 194.61.40.152:38303] [client 194.61.40.152] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "aeMi04CFeowknfXHM7mvUAAAAFE"]
[Sat Apr 18 14:21:07.914156 2026] [:error] [pid 9970:tid 9993] [client 194.61.40.111:29161] [client 194.61.40.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "aeMi0yYdRLRhVmaIMx1nBQAAANM"]
[Sat Apr 18 14:21:09.015310 2026] [:error] [pid 9863:tid 9878] [client 194.61.40.125:46607] [client 194.61.40.125] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aeMi1TjjiypiFrTucbKeEQAAAAU"]
[Sat Apr 18 14:21:10.939489 2026] [proxy_fcgi:error] [pid 34290:tid 34321] [client 194.61.40.150:28557] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 14:21:11.124331 2026] [proxy_fcgi:error] [pid 34290:tid 34328] [client 194.61.40.150:28557] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 14:21:11.315808 2026] [proxy_fcgi:error] [pid 34290:tid 34324] [client 194.61.40.150:28557] AH01071: Got error 'Primary script unknown'
[Sat Apr 18 14:21:12.238587 2026] [:error] [pid 34290:tid 34331] [client 194.61.40.150:28557] [client 194.61.40.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aeMi2BqX6WpmmAXOBi-_FgAAAcw"]
[Sat Apr 18 14:21:12.601098 2026] [:error] [pid 9864:tid 9920] [client 194.61.40.135:61679] [client 194.61.40.135] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "aeMi2ICFeowknfXHM7mvWAAAAE4"]
[Sat Apr 18 14:21:12.966414 2026] [:error] [pid 9864:tid 9918] [client 194.61.40.149:46275] [client 194.61.40.149] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "aeMi2ICFeowknfXHM7mvWwAAAEw"]
[Sat Apr 18 14:21:13.331718 2026] [:error] [pid 9864:tid 9929] [client 194.61.40.131:62343] [client 194.61.40.131] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "aeMi2YCFeowknfXHM7mvXgAAAFc"]
[Sat Apr 18 14:21:13.696335 2026] [:error] [pid 9864:tid 9907] [client 194.61.40.109:24713] [client 194.61.40.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "aeMi2YCFeowknfXHM7mvYQAAAEI"]
[Sat Apr 18 14:21:41.800841 2026] [autoindex:error] [pid 9970:tid 9989] [client 194.61.40.120:65037] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Sat Apr 18 16:10:13.191995 2026] [:error] [pid 34237:tid 34258] [client 106.220.104.114:5357] [client 106.220.104.114] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 106.220.104.114, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aeM8ZRBmX4Wq5a6rxfZIlAAAAVM"]
[Sat Apr 18 18:06:32.770340 2026] [:error] [pid 9865:tid 9959] [client 20.203.141.81:41801] [client 20.203.141.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeNXqKzb5knECIY-C-hs9QAAAJY"]
[Sat Apr 18 18:06:33.290864 2026] [:error] [pid 9970:tid 9984] [client 20.203.141.81:62809] [client 20.203.141.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeNXqSYdRLRhVmaIMx2cQgAAAMo"]
[Sat Apr 18 18:06:33.837238 2026] [:error] [pid 34237:tid 34243] [client 20.203.141.81:61823] [client 20.203.141.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeNXqRBmX4Wq5a6rxfZsTQAAAUQ"]
[Sat Apr 18 18:06:34.478731 2026] [:error] [pid 34290:tid 34339] [client 20.203.141.81:53344] [client 20.203.141.81] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeNXqhqX6WpmmAXOBi_3SwAAAdQ"]
[Sat Apr 18 22:06:38.531781 2026] [:error] [pid 32677:tid 32685] [client 40.83.91.255:1901] [client 40.83.91.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.83.91.255, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aeOP7hngmUE3LdC-wP7ppwAAAkU"]
[Sat Apr 18 22:06:39.639727 2026] [:error] [pid 32677:tid 32682] [client 40.83.91.255:1901] [client 40.83.91.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.83.91.255, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aeOP7xngmUE3LdC-wP7psQAAAkI"]
[Sat Apr 18 22:06:41.162783 2026] [:error] [pid 32677:tid 32685] [client 40.83.91.255:1901] [client 40.83.91.255] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aeOP8RngmUE3LdC-wP7pvQAAAkU"]
[Sun Apr 19 00:08:52.330753 2026] [:error] [pid 32166:tid 32210] [client 158.158.124.190:39462] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeOslJCHNkWwdiZnafK2nAAAAEw"]
[Sun Apr 19 00:08:53.214708 2026] [:error] [pid 32166:tid 32207] [client 158.158.124.190:39449] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeOslZCHNkWwdiZnafK2oQAAAEk"]
[Sun Apr 19 00:08:54.049506 2026] [:error] [pid 32252:tid 32271] [client 158.158.124.190:29255] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeOsluXl4Yc-Lt5fJ9h-RAAAARE"]
[Sun Apr 19 00:08:55.512412 2026] [:error] [pid 32166:tid 32213] [client 158.158.124.190:39436] [client 158.158.124.190] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aeOsl5CHNkWwdiZnafK2rQAAAE8"]
[Sun Apr 19 13:14:07.932343 2026] [:error] [pid 47775:tid 47850] [client 40.83.91.255:2612] [client 40.83.91.255] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 40.83.91.255, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aeRkn7mztjlk9tsmoezP1AAAAIc"]
[Sun Apr 19 13:14:10.430764 2026] [:error] [pid 47775:tid 47861] [client 40.83.91.255:2612] [client 40.83.91.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 40.83.91.255, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aeRkormztjlk9tsmoezP4AAAAJI"]
[Sun Apr 19 13:14:11.903782 2026] [:error] [pid 47775:tid 47863] [client 40.83.91.255:2612] [client 40.83.91.255] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aeRko7mztjlk9tsmoezP7gAAAJQ"]
[Sun Apr 19 13:45:15.726467 2026] [:error] [pid 15760:tid 15775] [client 8.229.224.4:60640] [client 8.229.224.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aeRr6_SdD_XHQMJ_IStkzwAAAcc"]
[Sun Apr 19 14:59:28.820278 2026] [:error] [pid 15763:tid 15819] [client 180.251.200.75:55070] [client 180.251.200.75] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 180.251.200.75, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aeR9ULMXv1Y1THOoxaCm2wAAAhc"]
[Sun Apr 19 19:13:46.216319 2026] [:error] [pid 47773:tid 47824] [client 213.35.109.170:57996] [client 213.35.109.170] ModSecurity: Access denied with code 403 (phase 2). Found 1 byte(s) in ARGS:auth outside range: 1-255. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "95"] [id "210410"] [rev "4"] [msg "COMODO WAF: Invalid character in request||paramountestate.com.au|F|3"] [data "ARGS:auth=\\x00"] [severity "ERROR"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-automatic/inc/csv.php"] [unique_id "aeS46uiBHdnCJDuPq9AnjwAAAEg"]
[Sun Apr 19 20:56:45.937771 2026] [:error] [pid 47775:tid 47853] [client 107.173.39.70:38684] [client 107.173.39.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aeTRDbmztjlk9tsmoewP5wAAAIo"]
[Sun Apr 19 20:56:46.156027 2026] [:error] [pid 15764:tid 15841] [client 107.173.39.70:38694] [client 107.173.39.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "aeTRDmLL_sqdSHoVp-QI3QAAAk8"]
[Sun Apr 19 20:56:48.016576 2026] [:error] [pid 15760:tid 15782] [client 107.173.39.70:38872] [client 107.173.39.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.local"] [unique_id "aeTREPSdD_XHQMJ_ISscWAAAAc4"]
[Sun Apr 19 20:56:48.103365 2026] [:error] [pid 47886:tid 47898] [client 107.173.39.70:38882] [client 107.173.39.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production"] [unique_id "aeTREESe8yiyuPrD7yNy8AAAAMo"]
[Sun Apr 19 20:56:48.711851 2026] [:error] [pid 15760:tid 15774] [client 107.173.39.70:38886] [client 107.173.39.70] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aeTREPSdD_XHQMJ_ISscWQAAAcY"]
[Sun Apr 19 22:04:15.334251 2026] [:error] [pid 47772:tid 47808] [client 138.68.5.226:60040] [client 138.68.5.226] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aeTg34c0L16cb4smAz_K_gAAABM"]
[Mon Apr 20 13:22:19.502302 2026] [:error] [pid 11351:tid 11392] [client 206.81.21.210:58370] [client 206.81.21.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.21.210, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aeW4CwN8Z1-vktaI_tODEAAAAEU"]
[Mon Apr 20 13:22:20.510503 2026] [:error] [pid 11351:tid 11399] [client 206.81.21.210:58421] [client 206.81.21.210] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.21.210, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aeW4DAN8Z1-vktaI_tODEwAAAEw"]
[Mon Apr 20 13:35:53.211390 2026] [:error] [pid 11441:tid 11459] [client 103.65.237.216:60788] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "aeW7OcixByFUvmh319D3ngAAANA"]
[Mon Apr 20 13:35:53.482848 2026] [:error] [pid 11441:tid 11462] [client 103.65.237.216:60876] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.vscode/sftp.json"] [unique_id "aeW7OcixByFUvmh319D3nwAAANM"]
[Mon Apr 20 13:51:39.872694 2026] [:error] [pid 11351:tid 11388] [client 122.162.150.121:28465] [client 122.162.150.121] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.162.150.121, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aeW-6wN8Z1-vktaI_tOKyQAAAEE"]
[Mon Apr 20 18:50:00.764081 2026] [:error] [pid 42014:tid 42017] [client 94.247.172.129:7021] [client 94.247.172.129] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||www.paramountestate.com.au|F|4"] [data "close, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "www.paramountestate.com.au"] [uri "/"] [unique_id "aeYE2Mek-00-ZI0f1NpsbQAAAQE"]
[Mon Apr 20 23:34:48.123778 2026] [:error] [pid 6928:tid 6951] [client 179.48.33.253:8408] [client 179.48.33.253] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 179.48.33.253, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aeZHmB3y7MHq1iB0qYrPxAAAAVU"]
[Tue Apr 21 04:00:23.168316 2026] [:error] [pid 35320:tid 35332] [client 185.194.178.199:30723] [client 185.194.178.199] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.199, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aeaF14JW6fdXWO6agMFcUwAAAAI"]
[Tue Apr 21 05:39:15.241446 2026] [:error] [pid 5377:tid 5409] [client 67.169.48.172:63000] [client 67.169.48.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 67.169.48.172, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aeadA7BKychFlrHBdvsMNAAAAdc"]
[Tue Apr 21 15:37:06.749831 2026] [:error] [pid 35321:tid 35401] [client 45.86.200.222:49313] [client 45.86.200.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "aecpIjeHLhVUuu8cVXypOgAAAFE"]
[Tue Apr 21 15:37:07.617502 2026] [:error] [pid 53978:tid 53999] [client 45.86.200.239:57161] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "aecpI51ivsR4hcOSQbawhAAAApM"]
[Tue Apr 21 15:37:18.257471 2026] [:error] [pid 53731:tid 53758] [client 185.82.72.106:36027] [client 185.82.72.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "aecpLl2I9THUR-bRVGzatwAAAhY"]
[Tue Apr 21 15:37:20.842985 2026] [:error] [pid 53978:tid 53993] [client 45.86.200.228:22719] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aecpMJ1ivsR4hcOSQbaw8wAAAo0"]
[Tue Apr 21 15:38:12.052422 2026] [:error] [pid 53832:tid 53848] [client 45.86.200.231:58507] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/execute.php"] [unique_id "aecpZNzkuxsE_OhM9UIYdwAAAk0"]
[Tue Apr 21 15:38:27.753907 2026] [:error] [pid 35321:tid 35397] [client 45.86.200.233:40015] [client 45.86.200.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/chosen.php"] [unique_id "aecpczeHLhVUuu8cVXywMwAAAE0"]
[Tue Apr 21 15:38:33.859535 2026] [:error] [pid 4823:tid 4862] [client 45.86.200.216:28073] [client 45.86.200.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/chosen.php"] [unique_id "aecpefc8mke3PfHqsxG9WQAAAYk"]
[Tue Apr 21 15:38:34.684019 2026] [:error] [pid 5377:tid 5401] [client 45.86.200.220:33379] [client 45.86.200.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "aecperBKychFlrHBdvvnzgAAAc8"]
[Tue Apr 21 15:38:35.215304 2026] [:error] [pid 53832:tid 53844] [client 45.86.200.216:54505] [client 45.86.200.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "aecpe9zkuxsE_OhM9UIZygAAAkk"]
[Tue Apr 21 15:38:36.021470 2026] [:error] [pid 53832:tid 53854] [client 45.86.200.235:57679] [client 45.86.200.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "aecpfNzkuxsE_OhM9UIZ2wAAAlM"]
[Tue Apr 21 15:38:37.662588 2026] [:error] [pid 53731:tid 53758] [client 45.86.200.247:32019] [client 45.86.200.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "aecpfV2I9THUR-bRVGzdBgAAAhY"]
[Tue Apr 21 15:38:38.219200 2026] [:error] [pid 5377:tid 5386] [client 45.86.200.226:22165] [client 45.86.200.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aecpfrBKychFlrHBdvvn4gAAAcA"]
[Tue Apr 21 15:38:39.604311 2026] [:error] [pid 35321:tid 35403] [client 45.86.200.248:47173] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "aecpfzeHLhVUuu8cVXyw7QAAAFM"]
[Tue Apr 21 15:38:41.287406 2026] [:error] [pid 53731:tid 53753] [client 45.86.200.227:22323] [client 45.86.200.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "aecpgV2I9THUR-bRVGzdHAAAAhE"]
[Tue Apr 21 15:38:41.829227 2026] [:error] [pid 53832:tid 53847] [client 45.86.200.228:65421] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "aecpgdzkuxsE_OhM9UIaIgAAAkw"]
[Tue Apr 21 15:38:42.363208 2026] [:error] [pid 4823:tid 4862] [client 185.82.72.107:44579] [client 185.82.72.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "aecpgvc8mke3PfHqsxG9mwAAAYk"]
[Tue Apr 21 15:38:42.894480 2026] [:error] [pid 53731:tid 53757] [client 45.86.200.219:38261] [client 45.86.200.219] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "aecpgl2I9THUR-bRVGzdJwAAAhU"]
[Tue Apr 21 15:38:45.622174 2026] [:error] [pid 4823:tid 4866] [client 45.86.200.217:23965] [client 45.86.200.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "aecphfc8mke3PfHqsxG9uQAAAY0"]
[Tue Apr 21 15:38:46.433967 2026] [:error] [pid 35321:tid 35398] [client 45.86.200.240:49509] [client 45.86.200.240] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.240, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "aecphjeHLhVUuu8cVXyxawAAAE4"]
[Tue Apr 21 15:38:47.273843 2026] [:error] [pid 35321:tid 35394] [client 45.86.200.240:49509] [client 45.86.200.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/class-config.php"] [unique_id "aecphzeHLhVUuu8cVXyxhAAAAEo"]
[Tue Apr 21 15:38:49.777180 2026] [:error] [pid 53978:tid 54004] [client 45.86.200.232:52483] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "aecpiZ1ivsR4hcOSQba0DQAAApg"]
[Tue Apr 21 15:38:51.445738 2026] [:error] [pid 35321:tid 35401] [client 45.86.200.232:46687] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/bak.php"] [unique_id "aecpizeHLhVUuu8cVXyxuwAAAFE"]
[Tue Apr 21 15:38:51.978790 2026] [:error] [pid 35321:tid 35395] [client 45.86.200.239:23415] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "aecpizeHLhVUuu8cVXyxwQAAAEs"]
[Tue Apr 21 15:38:53.058491 2026] [:error] [pid 5377:tid 5410] [client 45.86.200.245:57043] [client 45.86.200.245] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "aecpjbBKychFlrHBdvvoUAAAAdg"]
[Tue Apr 21 15:38:54.739196 2026] [:error] [pid 53832:tid 53848] [client 185.82.72.109:56623] [client 185.82.72.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/about.php"] [unique_id "aecpjtzkuxsE_OhM9UIa1gAAAk0"]
[Tue Apr 21 15:38:55.296688 2026] [:error] [pid 35415:tid 35439] [client 185.82.72.109:21797] [client 185.82.72.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/about.php"] [unique_id "aecpj0iqDinI4_22zzhZYQAAAMw"]
[Tue Apr 21 15:38:56.377120 2026] [:error] [pid 35415:tid 35427] [client 185.82.72.206:60247] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "aecpkEiqDinI4_22zzhZagAAAMA"]
[Tue Apr 21 15:38:56.935210 2026] [:error] [pid 53978:tid 54003] [client 45.86.200.235:51961] [client 45.86.200.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aecpkJ1ivsR4hcOSQba0SgAAApc"]
[Tue Apr 21 15:38:58.294400 2026] [:error] [pid 4823:tid 4855] [client 45.86.200.217:44193] [client 45.86.200.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "aecpkvc8mke3PfHqsxG-FAAAAYI"]
[Tue Apr 21 15:38:58.844827 2026] [:error] [pid 5377:tid 5402] [client 45.86.200.233:52149] [client 45.86.200.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Content/index.php"] [unique_id "aecpkrBKychFlrHBdvvodQAAAdA"]
[Tue Apr 21 15:38:59.374051 2026] [:error] [pid 54080:tid 54084] [client 45.86.200.248:28591] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "aecpk4zEbQHHxtmWbaZWogAAAsI"]
[Tue Apr 21 15:39:00.172539 2026] [:error] [pid 35320:tid 35331] [client 45.86.200.215:47615] [client 45.86.200.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/autoload_classmap.php"] [unique_id "aecplIJW6fdXWO6agMEe_AAAAAE"]
[Tue Apr 21 15:39:00.705316 2026] [:error] [pid 35320:tid 35334] [client 45.86.200.220:32151] [client 45.86.200.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "aecplIJW6fdXWO6agMEfCwAAAAQ"]
[Tue Apr 21 15:39:01.239342 2026] [:error] [pid 35320:tid 35351] [client 45.86.200.217:59909] [client 45.86.200.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "aecplYJW6fdXWO6agMEfEwAAABU"]
[Tue Apr 21 15:39:01.766042 2026] [:error] [pid 35321:tid 35407] [client 45.86.200.232:42053] [client 45.86.200.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/autoload_classmap.php"] [unique_id "aecplTeHLhVUuu8cVXyyKgAAAFc"]
[Tue Apr 21 15:39:02.307592 2026] [:error] [pid 35321:tid 35386] [client 45.86.200.239:41725] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "aecpljeHLhVUuu8cVXyyMAAAAEI"]
[Tue Apr 21 15:39:03.164555 2026] [:error] [pid 54080:tid 54101] [client 45.86.200.247:57123] [client 45.86.200.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "aecpl4zEbQHHxtmWbaZWzAAAAtM"]
[Tue Apr 21 15:39:05.382306 2026] [:error] [pid 35321:tid 35390] [client 45.86.200.228:21435] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "aecpmTeHLhVUuu8cVXyyXwAAAEY"]
[Tue Apr 21 15:39:05.921468 2026] [:error] [pid 53832:tid 53841] [client 45.86.200.227:58455] [client 45.86.200.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/network.php"] [unique_id "aecpmdzkuxsE_OhM9UIbNAAAAkY"]
[Tue Apr 21 15:39:06.483521 2026] [:error] [pid 4823:tid 4867] [client 45.86.200.246:38485] [client 45.86.200.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/php-compat/autoload_classmap.php"] [unique_id "aecpmvc8mke3PfHqsxG-VgAAAY4"]
[Tue Apr 21 15:39:07.565950 2026] [:error] [pid 35320:tid 35348] [client 45.86.200.244:61023] [client 45.86.200.244] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "aecpm4JW6fdXWO6agMEfagAAABI"]
[Tue Apr 21 15:39:08.099394 2026] [:error] [pid 4777:tid 4812] [client 45.86.200.227:47341] [client 45.86.200.227] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "aecpnKxXur6bykKyLZSJcwAAARg"]
[Tue Apr 21 15:39:09.248838 2026] [:error] [pid 53731:tid 53736] [client 45.86.200.228:24925] [client 45.86.200.228] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "aecpnV2I9THUR-bRVGzd8AAAAgE"]
[Tue Apr 21 15:39:10.060440 2026] [:error] [pid 4777:tid 4806] [client 185.82.72.9:58927] [client 185.82.72.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "aecpnqxXur6bykKyLZSJegAAARI"]
[Tue Apr 21 15:39:10.590381 2026] [:error] [pid 35321:tid 35404] [client 45.86.200.223:64031] [client 45.86.200.223] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aecpnjeHLhVUuu8cVXyyzwAAAFQ"]
[Tue Apr 21 15:39:11.131072 2026] [:error] [pid 5377:tid 5400] [client 45.86.200.246:61911] [client 45.86.200.246] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "aecpn7BKychFlrHBdvvo0wAAAc4"]
[Tue Apr 21 15:39:11.971069 2026] [:error] [pid 35321:tid 35397] [client 185.82.72.107:29887] [client 185.82.72.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aecpnzeHLhVUuu8cVXyy_gAAAE0"]
[Tue Apr 21 15:39:12.768878 2026] [:error] [pid 5377:tid 5406] [client 45.86.200.247:42139] [client 45.86.200.247] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "aecpoLBKychFlrHBdvvo3AAAAdQ"]
[Tue Apr 21 15:39:13.315081 2026] [:error] [pid 35321:tid 35408] [client 45.86.200.231:52955] [client 45.86.200.231] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "aecpoTeHLhVUuu8cVXyzJAAAAFg"]
[Tue Apr 21 15:39:13.872893 2026] [:error] [pid 35320:tid 35352] [client 45.86.200.238:38667] [client 45.86.200.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aecpoYJW6fdXWO6agMEfmgAAABY"]
[Tue Apr 21 15:39:14.409595 2026] [:error] [pid 4823:tid 4853] [client 45.86.200.248:34901] [client 45.86.200.248] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "aecpovc8mke3PfHqsxG-lQAAAYA"]
[Tue Apr 21 15:39:15.217083 2026] [:error] [pid 5377:tid 5393] [client 45.86.200.226:52237] [client 45.86.200.226] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/autoload_classmap.php"] [unique_id "aecpo7BKychFlrHBdvvo7AAAAcc"]
[Tue Apr 21 15:39:16.026667 2026] [:error] [pid 4823:tid 4862] [client 45.86.200.240:42279] [client 45.86.200.240] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/about.php"] [unique_id "aecppPc8mke3PfHqsxG-sgAAAYk"]
[Tue Apr 21 15:39:17.117042 2026] [:error] [pid 35415:tid 35427] [client 45.86.200.239:26557] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/autoload_classmap.php"] [unique_id "aecppUiqDinI4_22zzhaAAAAAMA"]
[Tue Apr 21 15:39:17.651510 2026] [:error] [pid 5377:tid 5390] [client 185.82.72.206:52517] [client 185.82.72.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "aecppbBKychFlrHBdvvpBAAAAcQ"]
[Tue Apr 21 15:39:18.184496 2026] [:error] [pid 53978:tid 53986] [client 185.82.72.182:27697] [client 185.82.72.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "aecppp1ivsR4hcOSQba1EgAAAoY"]
[Tue Apr 21 15:39:18.721107 2026] [:error] [pid 35320:tid 35333] [client 45.86.200.221:39701] [client 45.86.200.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "aecppoJW6fdXWO6agMEf0AAAAAM"]
[Tue Apr 21 15:39:19.273753 2026] [:error] [pid 5377:tid 5401] [client 45.86.200.233:61371] [client 45.86.200.233] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "aecpp7BKychFlrHBdvvpDQAAAc8"]
[Tue Apr 21 15:39:20.096418 2026] [:error] [pid 4823:tid 4853] [client 185.82.72.102:56127] [client 185.82.72.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.82.72.102, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "aecpqPc8mke3PfHqsxG-xgAAAYA"]
[Tue Apr 21 15:39:20.375250 2026] [:error] [pid 4823:tid 4855] [client 185.82.72.102:56127] [client 185.82.72.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "aecpqPc8mke3PfHqsxG-ygAAAYI"]
[Tue Apr 21 15:39:20.917250 2026] [:error] [pid 53832:tid 53851] [client 45.86.200.218:61179] [client 45.86.200.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "aecpqNzkuxsE_OhM9UIbtAAAAlA"]
[Tue Apr 21 15:39:21.780559 2026] [:error] [pid 35321:tid 35403] [client 45.86.200.239:64849] [client 45.86.200.239] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/autoload_classmap.php"] [unique_id "aecpqTeHLhVUuu8cVXyzkgAAAFM"]
[Tue Apr 21 15:39:22.335819 2026] [:error] [pid 53978:tid 53988] [client 45.86.200.250:26929] [client 45.86.200.250] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "aecpqp1ivsR4hcOSQba1PgAAAog"]
[Tue Apr 21 15:39:23.431134 2026] [:error] [pid 53978:tid 54002] [client 45.86.200.220:37041] [client 45.86.200.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "aecpq51ivsR4hcOSQba1TgAAApY"]
[Tue Apr 21 15:39:23.977692 2026] [:error] [pid 53731:tid 53742] [client 185.82.72.104:42253] [client 185.82.72.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "aecpq12I9THUR-bRVGzeVQAAAgc"]
[Tue Apr 21 15:39:24.535381 2026] [:error] [pid 35415:tid 35443] [client 185.82.72.108:28005] [client 185.82.72.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "aecprEiqDinI4_22zzhaJQAAANA"]
[Tue Apr 21 15:39:25.617511 2026] [:error] [pid 53731:tid 53757] [client 45.86.200.249:59191] [client 45.86.200.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Cache/about.php"] [unique_id "aecprV2I9THUR-bRVGzeXwAAAhU"]
[Tue Apr 21 15:39:26.174192 2026] [:error] [pid 5377:tid 5405] [client 45.86.200.249:48609] [client 45.86.200.249] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.249, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/wp-login.php"] [unique_id "aecprrBKychFlrHBdvvpJAAAAdM"]
[Tue Apr 21 15:39:27.030137 2026] [:error] [pid 5377:tid 5398] [client 45.86.200.249:48609] [client 45.86.200.249] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aecpr7BKychFlrHBdvvpKwAAAcw"]
[Tue Apr 21 16:56:40.431956 2026] [:error] [pid 35321:tid 35400] [client 160.30.179.124:33704] [client 160.30.179.124] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aec7yDeHLhVUuu8cVXzqewAAAFA"]
[Tue Apr 21 17:27:22.978779 2026] [:error] [pid 54080:tid 54095] [client 178.128.231.150:52785] [client 178.128.231.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.128.231.150, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aedC-ozEbQHHxtmWbaaFUQAAAs0"]
[Tue Apr 21 17:27:23.898709 2026] [:error] [pid 53731:tid 53739] [client 178.128.231.150:55610] [client 178.128.231.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.128.231.150, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aedC-12I9THUR-bRVGwPAAAAAgQ"]
[Tue Apr 21 19:19:18.880964 2026] [:error] [pid 54080:tid 54102] [client 64.227.40.102:50891] [client 64.227.40.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.40.102, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aeddNozEbQHHxtmWbaagdQAAAtQ"]
[Tue Apr 21 19:19:19.878725 2026] [:error] [pid 53978:tid 53996] [client 64.227.40.102:53093] [client 64.227.40.102] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 64.227.40.102, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aeddN51ivsR4hcOSQbYDjQAAApA"]
[Tue Apr 21 22:35:45.764356 2026] [:error] [pid 35321:tid 35393] [client 103.216.221.96:1183] [client 103.216.221.96] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.216.221.96, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aeeLQTeHLhVUuu8cVXzriwAAAEk"]
[Wed Apr 22 04:07:48.072657 2026] [:error] [pid 21683:tid 21750] [client 163.7.2.30:34212] [client 163.7.2.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.py"] [unique_id "aefZFFZBWT-0diZyYyZVsAAAAIA"]
[Wed Apr 22 04:10:10.612101 2026] [:error] [pid 21681:tid 21710] [client 163.7.2.30:56266] [client 163.7.2.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/Web.config" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/web.config"] [unique_id "aefZot5LmJziq-yZYawRTgAAABQ"]
[Wed Apr 22 04:10:10.737401 2026] [:error] [pid 21683:tid 21763] [client 163.7.2.30:56254] [client 163.7.2.30] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com.au|F|2"] [data ".config"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com.au"] [uri "/app.config"] [unique_id "aefZolZBWT-0diZyYyZWhAAAAI0"]
[Wed Apr 22 04:11:17.701466 2026] [:error] [pid 23041:tid 23061] [client 163.7.2.30:51972] [client 163.7.2.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aefZ5UTXx_lUa7xwAb57GgAAARE"]
[Wed Apr 22 04:11:18.502718 2026] [:error] [pid 23041:tid 23063] [client 163.7.2.30:51970] [client 163.7.2.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.local"] [unique_id "aefZ5kTXx_lUa7xwAb57HAAAARM"]
[Wed Apr 22 04:11:22.774187 2026] [:error] [pid 21788:tid 21805] [client 163.7.2.30:53770] [client 163.7.2.30] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production"] [unique_id "aefZ6n7OM27rzVpef2487gAAAM8"]
[Wed Apr 22 16:21:55.760456 2026] [:error] [pid 9085:tid 9095] [client 92.97.53.88:52387] [client 92.97.53.88] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 92.97.53.88, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aeiFI9-_-or9vQnlWnrAcgAAAUg"]
[Thu Apr 23 05:58:58.756911 2026] [:error] [pid 42973:tid 43056] [client 155.248.183.67:53098] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aelEom6I0QqmmmLTHE2kIAAAAI0"]
[Thu Apr 23 05:58:59.989725 2026] [:error] [pid 42973:tid 43062] [client 155.248.183.67:57431] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aelEo26I0QqmmmLTHE2kJQAAAJM"]
[Thu Apr 23 05:59:00.219126 2026] [:error] [pid 42973:tid 43051] [client 155.248.183.67:57431] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aelEpG6I0QqmmmLTHE2kJwAAAIg"]
[Thu Apr 23 05:59:01.447975 2026] [:error] [pid 42972:tid 43040] [client 155.248.183.67:53486] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aelEpcOAb-3sOknsk4fwOgAAAFg"]
[Thu Apr 23 05:59:02.676001 2026] [:error] [pid 42972:tid 43035] [client 155.248.183.67:60625] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aelEpsOAb-3sOknsk4fwQQAAAFM"]
[Thu Apr 23 07:22:41.776827 2026] [:error] [pid 42973:tid 43050] [client 89.251.0.129:63193] [client 89.251.0.129] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "aelYQW6I0QqmmmLTHE3S6AAAAIc"]
[Thu Apr 23 07:22:43.394564 2026] [:error] [pid 59700:tid 59705] [client 89.251.0.140:50665] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "aelYQ5XyGZJFeAIDWtlPtQAAAUM"]
[Thu Apr 23 07:22:46.430386 2026] [:error] [pid 64998:tid 65021] [client 89.251.0.134:53679] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "aelYRoV5EysYcTLjmwjptwAAAdM"]
[Thu Apr 23 07:22:48.137784 2026] [:error] [pid 65000:tid 65043] [client 89.251.0.124:26665] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aelYSL6vRb9j6psK2ZaFMAAAAgo"]
[Thu Apr 23 07:22:50.772480 2026] [:error] [pid 65000:tid 65030] [client 89.251.0.124:55273] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "aelYSr6vRb9j6psK2ZaFUQAAAgE"]
[Thu Apr 23 07:22:52.393631 2026] [:error] [pid 65000:tid 65050] [client 89.251.0.134:49369] [client 89.251.0.134] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "aelYTL6vRb9j6psK2ZaFZgAAAhE"]
[Thu Apr 23 07:22:53.049502 2026] [:error] [pid 65000:tid 65031] [client 89.251.0.146:57069] [client 89.251.0.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "aelYTb6vRb9j6psK2ZaFcgAAAgI"]
[Thu Apr 23 07:22:53.687538 2026] [:error] [pid 65000:tid 65047] [client 89.251.0.140:46145] [client 89.251.0.140] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "aelYTb6vRb9j6psK2ZaFggAAAg4"]
[Thu Apr 23 07:22:54.318536 2026] [:error] [pid 65000:tid 65055] [client 89.251.0.138:23611] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "aelYTr6vRb9j6psK2ZaFjQAAAhY"]
[Thu Apr 23 07:22:55.030468 2026] [:error] [pid 65000:tid 65038] [client 89.251.0.128:33847] [client 89.251.0.128] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "aelYT76vRb9j6psK2ZaFnwAAAgU"]
[Thu Apr 23 07:22:56.002834 2026] [:error] [pid 43083:tid 43099] [client 89.251.0.124:45879] [client 89.251.0.124] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "aelYTzC5hrvNXosL83LAbgAAAM4"]
[Thu Apr 23 07:22:58.258916 2026] [:error] [pid 65000:tid 65056] [client 89.251.0.138:37547] [client 89.251.0.138] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "aelYUr6vRb9j6psK2ZaGAgAAAhc"]
[Thu Apr 23 07:22:59.498578 2026] [:error] [pid 65000:tid 65044] [client 89.251.0.113:51967] [client 89.251.0.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "aelYU76vRb9j6psK2ZaGHQAAAgs"]
[Thu Apr 23 08:10:29.144401 2026] [:error] [pid 64998:tid 65013] [client 120.154.156.221:57763] [client 120.154.156.221] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 120.154.156.221, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aeljdYV5EysYcTLjmwgxOgAAAcs"]
[Thu Apr 23 09:51:45.796983 2026] [:error] [pid 64998:tid 65015] [client 91.230.225.195:26067] [client 91.230.225.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "ael7MYV5EysYcTLjmwhsagAAAc0"]
[Thu Apr 23 09:51:47.235294 2026] [:error] [pid 59700:tid 59713] [client 91.230.225.23:43613] [client 91.230.225.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "ael7M5XyGZJFeAIDWtmKwQAAAUs"]
[Thu Apr 23 09:51:49.485148 2026] [:error] [pid 42971:tid 42991] [client 185.192.71.32:49771] [client 185.192.71.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "ael7NTEP2_5RswrH8bHSdQAAAAU"]
[Thu Apr 23 09:51:50.894313 2026] [:error] [pid 59700:tid 59724] [client 185.192.71.30:56867] [client 185.192.71.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "ael7NpXyGZJFeAIDWtmLAgAAAVY"]
[Thu Apr 23 09:51:53.086661 2026] [:error] [pid 64967:tid 64975] [client 91.230.225.10:46661] [client 91.230.225.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "ael7OYAV4GfOOdX8Qzoo5QAAAYY"]
[Thu Apr 23 09:51:53.948225 2026] [:error] [pid 65000:tid 65029] [client 91.230.225.13:45775] [client 91.230.225.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "ael7Ob6vRb9j6psK2Zb0BgAAAgA"]
[Thu Apr 23 09:51:54.489819 2026] [:error] [pid 59700:tid 59711] [client 91.230.225.14:36201] [client 91.230.225.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "ael7OpXyGZJFeAIDWtmLPwAAAUk"]
[Thu Apr 23 09:51:55.148954 2026] [:error] [pid 64998:tid 65015] [client 91.230.225.20:26703] [client 91.230.225.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "ael7O4V5EysYcTLjmwhs0gAAAc0"]
[Thu Apr 23 09:51:55.722938 2026] [:error] [pid 42971:tid 43004] [client 91.230.225.202:65279] [client 91.230.225.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "ael7OzEP2_5RswrH8bHSlgAAABI"]
[Thu Apr 23 09:51:56.303409 2026] [:error] [pid 42973:tid 43067] [client 185.192.71.28:42065] [client 185.192.71.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "ael7PG6I0QqmmmLTHE3qjgAAAJg"]
[Thu Apr 23 09:51:57.192741 2026] [:error] [pid 42971:tid 42997] [client 91.230.225.19:55185] [client 91.230.225.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "ael7PTEP2_5RswrH8bHStQAAAAs"]
[Thu Apr 23 09:51:58.500345 2026] [:error] [pid 64998:tid 65015] [client 185.192.71.24:63045] [client 185.192.71.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "ael7PoV5EysYcTLjmwhs7wAAAc0"]
[Thu Apr 23 09:51:59.652624 2026] [:error] [pid 42973:tid 43053] [client 91.230.225.13:60153] [client 91.230.225.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "ael7P26I0QqmmmLTHE3qswAAAIo"]
[Thu Apr 23 09:52:00.534670 2026] [:error] [pid 43083:tid 43095] [client 185.192.71.31:25111] [client 185.192.71.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "ael7QDC5hrvNXosL83INxwAAAMo"]
[Thu Apr 23 09:52:01.381684 2026] [:error] [pid 42971:tid 43004] [client 91.230.225.203:45223] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "ael7QTEP2_5RswrH8bHS1QAAABI"]
[Thu Apr 23 09:52:03.722348 2026] [:error] [pid 64998:tid 65026] [client 185.192.71.27:59663] [client 185.192.71.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "ael7Q4V5EysYcTLjmwhtOAAAAdg"]
[Thu Apr 23 09:52:04.592711 2026] [:error] [pid 59700:tid 59715] [client 185.192.71.28:34673] [client 185.192.71.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "ael7RJXyGZJFeAIDWtmLowAAAU0"]
[Thu Apr 23 09:52:05.849447 2026] [:error] [pid 64998:tid 65017] [client 91.230.225.17:41965] [client 91.230.225.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "ael7RYV5EysYcTLjmwhtSQAAAc8"]
[Thu Apr 23 09:52:07.925920 2026] [:error] [pid 59700:tid 59712] [client 185.192.71.36:53209] [client 185.192.71.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "ael7R5XyGZJFeAIDWtmLzwAAAUo"]
[Thu Apr 23 09:52:09.727937 2026] [:error] [pid 43083:tid 43098] [client 91.230.225.203:33025] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "ael7STC5hrvNXosL83IOKQAAAM0"]
[Thu Apr 23 09:52:10.643584 2026] [:error] [pid 42973:tid 43066] [client 91.230.225.10:21733] [client 91.230.225.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "ael7Sm6I0QqmmmLTHE3rBwAAAJc"]
[Thu Apr 23 09:52:12.781154 2026] [:error] [pid 42972:tid 43029] [client 91.230.225.208:25845] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "ael7TMOAb-3sOknsk4c8BgAAAE0"]
[Thu Apr 23 09:52:13.326723 2026] [:error] [pid 43083:tid 43094] [client 185.192.71.29:47731] [client 185.192.71.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "ael7TTC5hrvNXosL83IORgAAAMk"]
[Thu Apr 23 09:52:14.203716 2026] [:error] [pid 64967:tid 64984] [client 91.230.225.208:63227] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ael7ToAV4GfOOdX8QzopdQAAAY8"]
[Thu Apr 23 09:52:15.672043 2026] [:error] [pid 42972:tid 43034] [client 91.230.225.201:21323] [client 91.230.225.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "ael7T8OAb-3sOknsk4c8UAAAAFI"]
[Thu Apr 23 09:52:16.254528 2026] [:error] [pid 64998:tid 65006] [client 91.230.225.15:54581] [client 91.230.225.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "ael7UIV5EysYcTLjmwhtwwAAAcQ"]
[Thu Apr 23 09:52:16.812331 2026] [:error] [pid 64998:tid 65025] [client 91.230.225.203:26921] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "ael7UIV5EysYcTLjmwhtzgAAAdc"]
[Thu Apr 23 09:52:19.666275 2026] [:error] [pid 64998:tid 65012] [client 185.192.71.26:64735] [client 185.192.71.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/admin.php"] [unique_id "ael7U4V5EysYcTLjmwhuEQAAAco"]
[Thu Apr 23 09:52:21.097512 2026] [:error] [pid 64967:tid 64991] [client 91.230.225.208:23517] [client 91.230.225.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.208, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "ael7VYAV4GfOOdX8QzopowAAAZY"]
[Thu Apr 23 09:52:24.669088 2026] [:error] [pid 64967:tid 64986] [client 91.230.225.208:23517] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "ael7WIAV4GfOOdX8Qzop3gAAAZE"]
[Thu Apr 23 09:52:25.816297 2026] [:error] [pid 65000:tid 65053] [client 185.92.25.114:42663] [client 185.92.25.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.92.25.114, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "ael7Wb6vRb9j6psK2Zb1MQAAAhQ"]
[Thu Apr 23 09:52:26.375623 2026] [:error] [pid 65000:tid 65055] [client 185.92.25.114:42663] [client 185.92.25.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/item.php"] [unique_id "ael7Wr6vRb9j6psK2Zb1NgAAAhY"]
[Thu Apr 23 09:52:29.311108 2026] [:error] [pid 64967:tid 64987] [client 91.230.225.196:25137] [client 91.230.225.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "ael7XYAV4GfOOdX8QzoqKwAAAZI"]
[Thu Apr 23 09:52:32.136457 2026] [:error] [pid 42972:tid 43030] [client 91.230.225.208:64155] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "ael7YMOAb-3sOknsk4c8_QAAAE4"]
[Thu Apr 23 09:52:33.249771 2026] [:error] [pid 42971:tid 42999] [client 185.92.25.113:50469] [client 185.92.25.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "ael7YTEP2_5RswrH8bHTvwAAAA0"]
[Thu Apr 23 09:52:34.696835 2026] [:error] [pid 64998:tid 65022] [client 91.230.225.205:59663] [client 91.230.225.205] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.205, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "ael7YoV5EysYcTLjmwhu5gAAAdQ"]
[Thu Apr 23 09:52:34.997279 2026] [:error] [pid 64998:tid 65025] [client 91.230.225.205:59663] [client 91.230.225.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "ael7YoV5EysYcTLjmwhu7wAAAdc"]
[Thu Apr 23 09:52:40.383318 2026] [:error] [pid 64998:tid 65017] [client 91.230.225.206:22631] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "ael7aIV5EysYcTLjmwhvgwAAAc8"]
[Thu Apr 23 09:52:41.832350 2026] [:error] [pid 43083:tid 43102] [client 91.230.225.198:38897] [client 91.230.225.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.198, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "ael7aTC5hrvNXosL83IPXwAAANE"]
[Thu Apr 23 09:52:42.974374 2026] [:error] [pid 43083:tid 43094] [client 91.230.225.198:38897] [client 91.230.225.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "ael7ajC5hrvNXosL83IPcgAAAMk"]
[Thu Apr 23 09:52:43.789735 2026] [:error] [pid 43083:tid 43094] [client 185.192.71.34:39361] [client 185.192.71.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/infi.php"] [unique_id "ael7azC5hrvNXosL83IPgQAAAMk"]
[Thu Apr 23 09:52:44.946615 2026] [:error] [pid 42971:tid 43006] [client 185.192.71.37:24321] [client 185.192.71.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "ael7bDEP2_5RswrH8bHT9wAAABQ"]
[Thu Apr 23 09:52:46.514023 2026] [:error] [pid 64998:tid 65015] [client 185.192.71.31:58691] [client 185.192.71.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "ael7boV5EysYcTLjmwhv3gAAAc0"]
[Thu Apr 23 09:52:47.075314 2026] [:error] [pid 42973:tid 43046] [client 91.230.225.11:54241] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "ael7b26I0QqmmmLTHE3r-AAAAIM"]
[Thu Apr 23 09:52:49.141678 2026] [:error] [pid 42972:tid 43018] [client 185.92.25.113:44637] [client 185.92.25.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "ael7ccOAb-3sOknsk4c9cwAAAEI"]
[Thu Apr 23 09:52:50.030129 2026] [:error] [pid 59700:tid 59705] [client 185.192.71.31:61061] [client 185.192.71.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "ael7cpXyGZJFeAIDWtmNUAAAAUM"]
[Thu Apr 23 09:52:51.442152 2026] [:error] [pid 64998:tid 65026] [client 91.230.225.24:41617] [client 91.230.225.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/edit.php"] [unique_id "ael7c4V5EysYcTLjmwhwSAAAAdg"]
[Thu Apr 23 09:52:52.918334 2026] [:error] [pid 59700:tid 59712] [client 91.230.225.197:26115] [client 91.230.225.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "ael7dJXyGZJFeAIDWtmNcwAAAUo"]
[Thu Apr 23 09:52:54.032191 2026] [:error] [pid 43083:tid 43102] [client 91.230.225.19:22103] [client 91.230.225.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/click.php"] [unique_id "ael7djC5hrvNXosL83IPxwAAANE"]
[Thu Apr 23 09:52:55.635070 2026] [:error] [pid 59700:tid 59720] [client 91.230.225.203:55861] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "ael7d5XyGZJFeAIDWtmNpgAAAVI"]
[Thu Apr 23 09:52:58.295644 2026] [:error] [pid 59700:tid 59715] [client 91.230.225.204:53713] [client 91.230.225.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "ael7epXyGZJFeAIDWtmN6AAAAU0"]
[Thu Apr 23 09:52:58.840374 2026] [:error] [pid 42972:tid 43022] [client 185.192.71.38:47983] [client 185.192.71.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "ael7esOAb-3sOknsk4c9pwAAAEY"]
[Thu Apr 23 09:52:59.603127 2026] [:error] [pid 43083:tid 43105] [client 185.192.71.22:28697] [client 185.192.71.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "ael7ezC5hrvNXosL83IP2gAAANQ"]
[Thu Apr 23 09:53:00.203155 2026] [:error] [pid 42972:tid 43023] [client 91.230.225.23:65453] [client 91.230.225.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "ael7fMOAb-3sOknsk4c9rgAAAEc"]
[Thu Apr 23 09:53:01.040107 2026] [:error] [pid 64998:tid 65010] [client 91.230.225.203:29275] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "ael7fYV5EysYcTLjmwhw4QAAAcg"]
[Thu Apr 23 09:53:01.618326 2026] [:error] [pid 42971:tid 43010] [client 91.230.225.201:58237] [client 91.230.225.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "ael7fTEP2_5RswrH8bHUzQAAABg"]
[Thu Apr 23 09:53:02.782080 2026] [:error] [pid 25635:tid 25644] [client 185.192.71.34:57631] [client 185.192.71.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "ael7fsRxv6UsgRGKB3L1QQAAAQU"]
[Thu Apr 23 09:53:03.329163 2026] [:error] [pid 65000:tid 65051] [client 185.192.71.29:29693] [client 185.192.71.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "ael7f76vRb9j6psK2Zb2wAAAAhI"]
[Thu Apr 23 09:53:03.888653 2026] [:error] [pid 25635:tid 25654] [client 91.230.225.23:34571] [client 91.230.225.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "ael7f8Rxv6UsgRGKB3L1RgAAAQ8"]
[Thu Apr 23 09:53:04.488092 2026] [:error] [pid 42973:tid 43061] [client 91.230.225.208:53531] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "ael7gG6I0QqmmmLTHE3sWAAAAJI"]
[Thu Apr 23 09:53:05.341990 2026] [:error] [pid 59700:tid 59715] [client 185.192.71.30:23367] [client 185.192.71.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "ael7gZXyGZJFeAIDWtmOUAAAAU0"]
[Thu Apr 23 09:53:06.506108 2026] [:error] [pid 64967:tid 64993] [client 91.230.225.17:62461] [client 91.230.225.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "ael7goAV4GfOOdX8Qzoq_AAAAZg"]
[Thu Apr 23 09:53:08.170839 2026] [:error] [pid 42972:tid 43024] [client 91.230.225.11:29977] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "ael7hMOAb-3sOknsk4c-IwAAAEg"]
[Thu Apr 23 09:53:14.851569 2026] [:error] [pid 64998:tid 65008] [client 185.192.71.36:64653] [client 185.192.71.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "ael7ioV5EysYcTLjmwhxgwAAAcY"]
[Thu Apr 23 09:53:16.515205 2026] [:error] [pid 42971:tid 42989] [client 185.192.71.35:51517] [client 185.192.71.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "ael7jDEP2_5RswrH8bHVfwAAAAM"]
[Thu Apr 23 09:53:17.062636 2026] [:error] [pid 64998:tid 65012] [client 185.92.25.114:34985] [client 185.92.25.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "ael7jYV5EysYcTLjmwhxkwAAAco"]
[Thu Apr 23 09:53:18.798454 2026] [:error] [pid 43083:tid 43088] [client 185.192.71.40:23817] [client 185.192.71.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "ael7jjC5hrvNXosL83IQQgAAAMM"]
[Thu Apr 23 09:53:20.322295 2026] [proxy_fcgi:error] [pid 64967:tid 64970] [client 91.230.225.205:60979] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:53:20.622676 2026] [proxy_fcgi:error] [pid 64967:tid 64985] [client 91.230.225.205:60979] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:53:20.926286 2026] [proxy_fcgi:error] [pid 64967:tid 64974] [client 91.230.225.205:60979] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:53:22.407457 2026] [:error] [pid 64967:tid 64981] [client 91.230.225.205:60979] [client 91.230.225.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "ael7koAV4GfOOdX8QzorfgAAAYw"]
[Thu Apr 23 09:53:22.960559 2026] [:error] [pid 64998:tid 65002] [client 91.230.225.206:23215] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "ael7koV5EysYcTLjmwhx1AAAAcA"]
[Thu Apr 23 09:53:23.541415 2026] [:error] [pid 43083:tid 43094] [client 91.230.225.24:51465] [client 91.230.225.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "ael7kzC5hrvNXosL83IQhgAAAMk"]
[Thu Apr 23 09:53:24.103847 2026] [:error] [pid 65000:tid 65057] [client 185.192.71.33:52259] [client 185.192.71.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "ael7lL6vRb9j6psK2Zb4BgAAAhg"]
[Thu Apr 23 09:53:24.649820 2026] [:error] [pid 43083:tid 43088] [client 185.192.71.27:61949] [client 185.192.71.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "ael7lDC5hrvNXosL83IQnQAAAMM"]
[Thu Apr 23 09:53:25.226059 2026] [:error] [pid 42972:tid 43016] [client 185.192.71.23:41005] [client 185.192.71.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "ael7lcOAb-3sOknsk4c-tAAAAEA"]
[Thu Apr 23 09:53:26.136039 2026] [:error] [pid 42973:tid 43065] [client 91.230.225.17:56919] [client 91.230.225.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "ael7lm6I0QqmmmLTHE3stAAAAJY"]
[Thu Apr 23 09:53:26.700467 2026] [:error] [pid 64967:tid 64976] [client 91.230.225.21:53477] [client 91.230.225.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "ael7loAV4GfOOdX8QzoroQAAAYc"]
[Thu Apr 23 09:53:27.290656 2026] [:error] [pid 65000:tid 65039] [client 185.192.71.28:48823] [client 185.192.71.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "ael7l76vRb9j6psK2Zb4MQAAAgY"]
[Thu Apr 23 09:53:27.854510 2026] [:error] [pid 42972:tid 43033] [client 91.230.225.208:40559] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "ael7l8OAb-3sOknsk4c-zAAAAFE"]
[Thu Apr 23 09:53:29.015111 2026] [:error] [pid 64998:tid 65019] [client 91.230.225.12:22919] [client 91.230.225.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "ael7mYV5EysYcTLjmwhyIAAAAdE"]
[Thu Apr 23 09:53:29.863707 2026] [:error] [pid 42971:tid 42988] [client 185.192.71.35:34939] [client 185.192.71.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "ael7mTEP2_5RswrH8bHWJgAAAAI"]
[Thu Apr 23 09:53:31.115568 2026] [:error] [pid 64998:tid 65017] [client 91.230.225.16:25353] [client 91.230.225.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "ael7m4V5EysYcTLjmwhyTQAAAc8"]
[Thu Apr 23 09:53:32.296611 2026] [:error] [pid 42972:tid 43035] [client 185.192.71.22:30019] [client 185.192.71.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "ael7nMOAb-3sOknsk4c-5QAAAFM"]
[Thu Apr 23 09:53:33.908788 2026] [:error] [pid 65000:tid 65032] [client 185.92.25.114:60053] [client 185.92.25.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "ael7nb6vRb9j6psK2Zb4eAAAAgM"]
[Thu Apr 23 09:53:36.801088 2026] [:error] [pid 64967:tid 64982] [client 91.230.225.206:55705] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "ael7oIAV4GfOOdX8QzosAgAAAY0"]
[Thu Apr 23 09:53:37.702360 2026] [:error] [pid 64998:tid 65005] [client 185.92.25.114:57835] [client 185.92.25.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "ael7oYV5EysYcTLjmwhyrgAAAcM"]
[Thu Apr 23 09:53:47.223217 2026] [:error] [pid 59700:tid 59715] [client 185.192.71.24:53829] [client 185.192.71.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "ael7q5XyGZJFeAIDWtmP1wAAAU0"]
[Thu Apr 23 09:53:47.759964 2026] [:error] [pid 64998:tid 65014] [client 91.230.225.204:41019] [client 91.230.225.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "ael7q4V5EysYcTLjmwhzVwAAAcw"]
[Thu Apr 23 09:53:48.584800 2026] [:error] [pid 59700:tid 59704] [client 91.230.225.205:35501] [client 91.230.225.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "ael7rJXyGZJFeAIDWtmP3gAAAUI"]
[Thu Apr 23 09:53:49.776407 2026] [:error] [pid 25635:tid 25646] [client 185.192.71.30:49571] [client 185.192.71.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "ael7rcRxv6UsgRGKB3L2hAAAAQc"]
[Thu Apr 23 09:53:50.336392 2026] [:error] [pid 43083:tid 43085] [client 185.192.71.26:55863] [client 185.192.71.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "ael7rjC5hrvNXosL83IR5QAAAMA"]
[Thu Apr 23 09:53:52.056255 2026] [:error] [pid 42972:tid 43035] [client 91.230.225.23:23811] [client 91.230.225.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ael7sMOAb-3sOknsk4c_wQAAAFM"]
[Thu Apr 23 09:53:52.648049 2026] [:error] [pid 43083:tid 43107] [client 185.192.71.37:61813] [client 185.192.71.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "ael7sDC5hrvNXosL83IR_QAAANY"]
[Thu Apr 23 09:53:54.687220 2026] [:error] [pid 25635:tid 25646] [client 185.192.71.37:26997] [client 185.192.71.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "ael7ssRxv6UsgRGKB3L2rwAAAQc"]
[Thu Apr 23 09:53:55.557082 2026] [proxy_fcgi:error] [pid 64967:tid 64977] [client 91.230.225.202:42869] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:53:56.122369 2026] [:error] [pid 64967:tid 64983] [client 91.230.225.202:42869] [client 91.230.225.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/function.php"] [unique_id "ael7tIAV4GfOOdX8Qzos4AAAAY4"]
[Thu Apr 23 09:53:56.824467 2026] [:error] [pid 42971:tid 42993] [client 91.230.225.13:27275] [client 91.230.225.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "ael7tDEP2_5RswrH8bHW8wAAAAc"]
[Thu Apr 23 09:53:57.993115 2026] [:error] [pid 43083:tid 43097] [client 185.192.71.39:23633] [client 185.192.71.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "ael7tTC5hrvNXosL83ISXAAAAMw"]
[Thu Apr 23 09:53:58.621297 2026] [:error] [pid 42973:tid 43062] [client 91.230.225.11:62223] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "ael7tm6I0QqmmmLTHE3tiAAAAJM"]
[Thu Apr 23 09:54:01.218364 2026] [:error] [pid 42973:tid 43050] [client 91.230.225.11:31257] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "ael7uW6I0QqmmmLTHE3twQAAAIc"]
[Thu Apr 23 09:54:01.808632 2026] [:error] [pid 64967:tid 64979] [client 185.192.71.22:60609] [client 185.192.71.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "ael7uYAV4GfOOdX8QzotEgAAAYo"]
[Thu Apr 23 09:54:03.607122 2026] [:error] [pid 42972:tid 43017] [client 185.192.71.22:41239] [client 185.192.71.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "ael7u8OAb-3sOknsk4dAUwAAAEE"]
[Thu Apr 23 09:54:04.274630 2026] [:error] [pid 64998:tid 65018] [client 185.192.71.36:58353] [client 185.192.71.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "ael7vIV5EysYcTLjmwhz_QAAAdA"]
[Thu Apr 23 09:54:04.868999 2026] [:error] [pid 42971:tid 42986] [client 91.230.225.203:22131] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "ael7vDEP2_5RswrH8bHXTQAAAAA"]
[Thu Apr 23 09:54:07.094705 2026] [:error] [pid 42972:tid 43036] [client 185.192.71.30:63991] [client 185.192.71.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "ael7v8OAb-3sOknsk4dAmgAAAFQ"]
[Thu Apr 23 09:54:07.970792 2026] [:error] [pid 42971:tid 42988] [client 91.230.225.22:32025] [client 91.230.225.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "ael7vzEP2_5RswrH8bHXYAAAAAI"]
[Thu Apr 23 09:54:10.554785 2026] [:error] [pid 42973:tid 43059] [client 91.230.225.197:36385] [client 91.230.225.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.197, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/js/wp-login.php"] [unique_id "ael7wm6I0QqmmmLTHE3uOQAAAJA"]
[Thu Apr 23 09:54:12.355890 2026] [:error] [pid 42973:tid 43064] [client 91.230.225.197:36385] [client 91.230.225.197] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.197, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "ael7xG6I0QqmmmLTHE3uWwAAAJU"]
[Thu Apr 23 09:54:15.704151 2026] [proxy_fcgi:error] [pid 42973:tid 43047] [client 91.230.225.197:36385] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:54:20.159727 2026] [:error] [pid 42973:tid 43065] [client 91.230.225.197:36385] [client 91.230.225.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "ael7zG6I0QqmmmLTHE3u3QAAAJY"]
[Thu Apr 23 09:54:21.629604 2026] [:error] [pid 65000:tid 65054] [client 91.230.225.201:53665] [client 91.230.225.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "ael7zb6vRb9j6psK2Zb6RgAAAhU"]
[Thu Apr 23 09:54:22.753140 2026] [:error] [pid 42973:tid 43046] [client 185.192.71.25:52349] [client 185.192.71.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "ael7zm6I0QqmmmLTHE3u_wAAAIM"]
[Thu Apr 23 09:54:25.960985 2026] [:error] [pid 65000:tid 65030] [client 185.192.71.32:52929] [client 185.192.71.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "ael70b6vRb9j6psK2Zb6swAAAgE"]
[Thu Apr 23 09:54:27.094663 2026] [:error] [pid 64967:tid 64989] [client 185.192.71.39:27105] [client 185.192.71.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ael704AV4GfOOdX8QzouGwAAAZQ"]
[Thu Apr 23 09:54:27.914174 2026] [:error] [pid 42973:tid 43057] [client 91.230.225.20:27863] [client 91.230.225.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "ael7026I0QqmmmLTHE3vPgAAAI4"]
[Thu Apr 23 09:54:29.623294 2026] [proxy_fcgi:error] [pid 64998:tid 65016] [client 91.230.225.13:29395] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:54:29.943292 2026] [proxy_fcgi:error] [pid 64998:tid 65006] [client 91.230.225.13:29395] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:54:30.241436 2026] [:error] [pid 64998:tid 65022] [client 91.230.225.13:29395] [client 91.230.225.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "ael71oV5EysYcTLjmwh1XwAAAdQ"]
[Thu Apr 23 09:54:30.812329 2026] [:error] [pid 65000:tid 65038] [client 91.230.225.12:61033] [client 91.230.225.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "ael71r6vRb9j6psK2Zb66wAAAgU"]
[Thu Apr 23 09:54:33.296446 2026] [:error] [pid 42972:tid 43016] [client 91.230.225.206:61849] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "ael72cOAb-3sOknsk4dBuAAAAEA"]
[Thu Apr 23 09:54:34.150163 2026] [:error] [pid 65000:tid 65045] [client 185.192.71.39:42975] [client 185.192.71.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "ael72r6vRb9j6psK2Zb7QAAAAgw"]
[Thu Apr 23 09:54:35.542197 2026] [:error] [pid 64998:tid 65024] [client 91.230.225.202:42967] [client 91.230.225.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "ael724V5EysYcTLjmwh1xQAAAdY"]
[Thu Apr 23 09:54:38.022676 2026] [:error] [pid 42972:tid 43038] [client 91.230.225.12:63651] [client 91.230.225.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "ael73sOAb-3sOknsk4dCBQAAAFY"]
[Thu Apr 23 09:54:38.590288 2026] [proxy_fcgi:error] [pid 43083:tid 43101] [client 185.192.71.31:29503] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:54:39.423365 2026] [:error] [pid 43083:tid 43088] [client 185.192.71.31:29503] [client 185.192.71.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "ael73zC5hrvNXosL83IUYgAAAMM"]
[Thu Apr 23 09:54:41.408517 2026] [proxy_fcgi:error] [pid 43083:tid 43094] [client 91.230.225.20:65055] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:54:41.962115 2026] [:error] [pid 43083:tid 43094] [client 91.230.225.20:65055] [client 91.230.225.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "ael74TC5hrvNXosL83IUpwAAAMk"]
[Thu Apr 23 09:54:43.386291 2026] [:error] [pid 43083:tid 43088] [client 91.230.225.20:65055] [client 91.230.225.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "ael74zC5hrvNXosL83IUvAAAAMM"]
[Thu Apr 23 09:54:44.212291 2026] [:error] [pid 42971:tid 42998] [client 91.230.225.204:29505] [client 91.230.225.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "ael75DEP2_5RswrH8bHYrwAAAAw"]
[Thu Apr 23 09:54:45.863396 2026] [:error] [pid 25635:tid 25647] [client 91.230.225.197:61169] [client 91.230.225.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "ael75cRxv6UsgRGKB3L4iAAAAQg"]
[Thu Apr 23 09:54:47.234168 2026] [:error] [pid 59700:tid 59713] [client 91.230.225.15:56877] [client 91.230.225.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "ael755XyGZJFeAIDWtmSPwAAAUs"]
[Thu Apr 23 09:54:47.812580 2026] [:error] [pid 64998:tid 65004] [client 185.192.71.22:20375] [client 185.192.71.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "ael754V5EysYcTLjmwh2kAAAAcI"]
[Thu Apr 23 09:54:49.266368 2026] [:error] [pid 64998:tid 65015] [client 91.230.225.204:64393] [client 91.230.225.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "ael76YV5EysYcTLjmwh22gAAAc0"]
[Thu Apr 23 09:54:50.408314 2026] [proxy_fcgi:error] [pid 59700:tid 59711] [client 185.192.71.35:55933] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:54:50.700860 2026] [:error] [pid 59700:tid 59723] [client 185.192.71.35:55933] [client 185.192.71.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "ael76pXyGZJFeAIDWtmSkAAAAVU"]
[Thu Apr 23 09:54:51.522861 2026] [:error] [pid 65000:tid 65054] [client 91.230.225.22:30545] [client 91.230.225.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/db.php"] [unique_id "ael7676vRb9j6psK2Zb8fQAAAhU"]
[Thu Apr 23 09:54:52.071229 2026] [:error] [pid 43083:tid 43092] [client 91.230.225.204:62007] [client 91.230.225.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "ael77DC5hrvNXosL83IU_AAAAMc"]
[Thu Apr 23 09:54:52.606534 2026] [:error] [pid 43083:tid 43099] [client 91.230.225.13:37445] [client 91.230.225.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ael77DC5hrvNXosL83IVAQAAAM4"]
[Thu Apr 23 09:54:53.180497 2026] [:error] [pid 65000:tid 65040] [client 91.230.225.208:32785] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "ael77b6vRb9j6psK2Zb8ngAAAgc"]
[Thu Apr 23 09:54:53.718326 2026] [:error] [pid 43083:tid 43098] [client 185.192.71.34:21143] [client 185.192.71.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "ael77TC5hrvNXosL83IVEwAAAM0"]
[Thu Apr 23 09:54:54.257342 2026] [:error] [pid 64967:tid 64972] [client 185.192.71.23:46255] [client 185.192.71.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "ael77oAV4GfOOdX8QzovJgAAAYM"]
[Thu Apr 23 09:54:55.348346 2026] [:error] [pid 42973:tid 43044] [client 185.192.71.27:45461] [client 185.192.71.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "ael7726I0QqmmmLTHE3wLgAAAIE"]
[Thu Apr 23 09:54:55.927347 2026] [:error] [pid 59700:tid 59717] [client 185.192.71.21:25515] [client 185.192.71.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "ael775XyGZJFeAIDWtmS0wAAAU8"]
[Thu Apr 23 09:54:56.469666 2026] [:error] [pid 43083:tid 43104] [client 185.92.25.113:31401] [client 185.92.25.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "ael78DC5hrvNXosL83IVMwAAANM"]
[Thu Apr 23 09:54:57.024066 2026] [:error] [pid 43083:tid 43109] [client 185.92.25.113:36769] [client 185.92.25.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "ael78TC5hrvNXosL83IVPQAAANg"]
[Thu Apr 23 09:54:57.589645 2026] [:error] [pid 42973:tid 43056] [client 91.230.225.206:60373] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "ael78W6I0QqmmmLTHE3wSgAAAI0"]
[Thu Apr 23 09:55:06.240754 2026] [proxy_fcgi:error] [pid 25635:tid 25661] [client 185.192.71.30:60483] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:55:07.079331 2026] [:error] [pid 25635:tid 25659] [client 185.192.71.30:60483] [client 185.192.71.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.30, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "ael7-8Rxv6UsgRGKB3L5KgAAARQ"]
[Thu Apr 23 09:55:08.519081 2026] [:error] [pid 25635:tid 25663] [client 185.192.71.30:60483] [client 185.192.71.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "ael7_MRxv6UsgRGKB3L5PQAAARg"]
[Thu Apr 23 09:55:13.634513 2026] [:error] [pid 25635:tid 25658] [client 91.230.225.204:51155] [client 91.230.225.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "ael8AcRxv6UsgRGKB3L5jQAAARM"]
[Thu Apr 23 09:55:15.193452 2026] [:error] [pid 65000:tid 65037] [client 185.192.71.34:26895] [client 185.192.71.34] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "ael8A76vRb9j6psK2Zb95gAAAgQ"]
[Thu Apr 23 09:55:15.759443 2026] [:error] [pid 43083:tid 43093] [client 185.192.71.23:43571] [client 185.192.71.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "ael8AzC5hrvNXosL83IV9wAAAMg"]
[Thu Apr 23 09:55:17.144492 2026] [:error] [pid 65000:tid 65032] [client 91.230.225.208:36627] [client 91.230.225.208] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/wp-conflg.php"] [unique_id "ael8Bb6vRb9j6psK2Zb-GwAAAgM"]
[Thu Apr 23 09:55:18.550950 2026] [:error] [pid 64998:tid 65018] [client 185.192.71.33:42681] [client 185.192.71.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "ael8BoV5EysYcTLjmwh5hAAAAdA"]
[Thu Apr 23 09:55:23.040800 2026] [:error] [pid 64967:tid 64989] [client 91.230.225.197:50611] [client 91.230.225.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "ael8C4AV4GfOOdX8QzowlQAAAZQ"]
[Thu Apr 23 09:55:23.584322 2026] [:error] [pid 59700:tid 59714] [client 185.192.71.32:50375] [client 185.192.71.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "ael8C5XyGZJFeAIDWtmTiAAAAUw"]
[Thu Apr 23 09:55:25.258602 2026] [:error] [pid 64998:tid 65007] [client 91.230.225.203:24395] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "ael8DYV5EysYcTLjmwh59gAAAcU"]
[Thu Apr 23 09:55:26.074898 2026] [:error] [pid 65000:tid 65029] [client 185.192.71.27:48993] [client 185.192.71.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "ael8Dr6vRb9j6psK2Zb-tQAAAgA"]
[Thu Apr 23 09:55:27.196646 2026] [:error] [pid 59700:tid 59713] [client 185.192.71.25:51929] [client 185.192.71.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "ael8D5XyGZJFeAIDWtmTnQAAAUs"]
[Thu Apr 23 09:55:30.928003 2026] [:error] [pid 59700:tid 59710] [client 91.230.225.198:51281] [client 91.230.225.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "ael8EpXyGZJFeAIDWtmT5AAAAUg"]
[Thu Apr 23 09:55:31.758845 2026] [:error] [pid 43083:tid 43096] [client 185.192.71.27:61335] [client 185.192.71.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/about.php"] [unique_id "ael8EzC5hrvNXosL83IWygAAAMs"]
[Thu Apr 23 09:55:33.975870 2026] [:error] [pid 65000:tid 65051] [client 91.230.225.200:58361] [client 91.230.225.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "ael8Fb6vRb9j6psK2Zb_HgAAAhI"]
[Thu Apr 23 09:55:35.153347 2026] [:error] [pid 64967:tid 64969] [client 91.230.225.16:58815] [client 91.230.225.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "ael8F4AV4GfOOdX8QzoxSgAAAYA"]
[Thu Apr 23 09:55:36.852609 2026] [:error] [pid 42973:tid 43064] [client 91.230.225.199:31073] [client 91.230.225.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "ael8GG6I0QqmmmLTHE3yBAAAAJU"]
[Thu Apr 23 09:55:38.499584 2026] [:error] [pid 64998:tid 65025] [client 91.230.225.11:21199] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "ael8GoV5EysYcTLjmwh6swAAAdc"]
[Thu Apr 23 09:55:39.644694 2026] [:error] [pid 42973:tid 43049] [client 185.192.71.40:55079] [client 185.192.71.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "ael8G26I0QqmmmLTHE3yFAAAAIY"]
[Thu Apr 23 09:55:40.190365 2026] [:error] [pid 59700:tid 59714] [client 91.230.225.203:56161] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "ael8HJXyGZJFeAIDWtmURwAAAUw"]
[Thu Apr 23 09:55:42.134254 2026] [:error] [pid 42972:tid 43040] [client 185.192.71.38:60441] [client 185.192.71.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "ael8HsOAb-3sOknsk4dE0wAAAFg"]
[Thu Apr 23 09:55:44.170789 2026] [:error] [pid 59700:tid 59708] [client 91.230.225.17:63641] [client 91.230.225.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "ael8IJXyGZJFeAIDWtmUmgAAAUY"]
[Thu Apr 23 09:55:45.817109 2026] [:error] [pid 64998:tid 65005] [client 185.192.71.38:65287] [client 185.192.71.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "ael8IYV5EysYcTLjmwh7RAAAAcM"]
[Thu Apr 23 09:55:46.361370 2026] [:error] [pid 25635:tid 25662] [client 91.230.225.203:43145] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "ael8IsRxv6UsgRGKB3L68AAAARc"]
[Thu Apr 23 09:55:47.210336 2026] [:error] [pid 42971:tid 42996] [client 91.230.225.18:64729] [client 91.230.225.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "ael8IzEP2_5RswrH8bHbawAAAAo"]
[Thu Apr 23 09:55:48.313219 2026] [:error] [pid 25635:tid 25661] [client 185.192.71.26:64827] [client 185.192.71.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "ael8JMRxv6UsgRGKB3L7DwAAARY"]
[Thu Apr 23 09:55:49.976781 2026] [:error] [pid 42973:tid 43055] [client 185.192.71.29:27877] [client 185.192.71.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "ael8JW6I0QqmmmLTHE3ybgAAAIw"]
[Thu Apr 23 09:55:52.260083 2026] [:error] [pid 25635:tid 25642] [client 91.230.225.24:32553] [client 91.230.225.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "ael8KMRxv6UsgRGKB3L7TAAAAQM"]
[Thu Apr 23 09:55:53.366939 2026] [:error] [pid 65000:tid 65031] [client 91.230.225.22:49753] [client 91.230.225.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "ael8Kb6vRb9j6psK2ZYAUAAAAgI"]
[Thu Apr 23 09:55:53.924135 2026] [:error] [pid 64967:tid 64987] [client 91.230.225.209:58545] [client 91.230.225.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "ael8KYAV4GfOOdX8Qzox4QAAAZI"]
[Thu Apr 23 09:55:55.027402 2026] [:error] [pid 43083:tid 43086] [client 185.192.71.35:53423] [client 185.192.71.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "ael8KzC5hrvNXosL83IYCgAAAME"]
[Thu Apr 23 09:55:55.859250 2026] [:error] [pid 65000:tid 65030] [client 185.192.71.32:26929] [client 185.192.71.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "ael8K76vRb9j6psK2ZYAdAAAAgE"]
[Thu Apr 23 09:55:57.852054 2026] [:error] [pid 42972:tid 43037] [client 91.230.225.204:40989] [client 91.230.225.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "ael8LcOAb-3sOknsk4dFQwAAAFU"]
[Thu Apr 23 09:55:58.971162 2026] [:error] [pid 43083:tid 43088] [client 91.230.225.16:32669] [client 91.230.225.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "ael8LjC5hrvNXosL83IYRAAAAMM"]
[Thu Apr 23 09:56:00.073710 2026] [:error] [pid 65000:tid 65055] [client 185.192.71.40:34403] [client 185.192.71.40] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "ael8ML6vRb9j6psK2ZYAqgAAAhY"]
[Thu Apr 23 09:56:00.971639 2026] [:error] [pid 42973:tid 43056] [client 91.230.225.14:62039] [client 91.230.225.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/as.php"] [unique_id "ael8MG6I0QqmmmLTHE3y-AAAAI0"]
[Thu Apr 23 09:56:01.827385 2026] [:error] [pid 59700:tid 59716] [client 91.230.225.13:55389] [client 91.230.225.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "ael8MZXyGZJFeAIDWtmVgAAAAU4"]
[Thu Apr 23 09:56:03.378332 2026] [:error] [pid 59700:tid 59702] [client 185.192.71.21:65437] [client 185.192.71.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/install.php"] [unique_id "ael8M5XyGZJFeAIDWtmVlgAAAUA"]
[Thu Apr 23 09:56:03.921972 2026] [:error] [pid 43083:tid 43096] [client 91.230.225.19:59129] [client 91.230.225.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "ael8MzC5hrvNXosL83IYagAAAMs"]
[Thu Apr 23 09:56:07.246999 2026] [:error] [pid 42971:tid 42989] [client 91.230.225.24:60827] [client 91.230.225.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "ael8NzEP2_5RswrH8bHcgQAAAAM"]
[Thu Apr 23 09:56:08.618088 2026] [:error] [pid 65000:tid 65029] [client 91.230.225.14:31407] [client 91.230.225.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "ael8OL6vRb9j6psK2ZYBJQAAAgA"]
[Thu Apr 23 09:56:09.740727 2026] [:error] [pid 59700:tid 59717] [client 185.192.71.35:39243] [client 185.192.71.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "ael8OZXyGZJFeAIDWtmV3AAAAU8"]
[Thu Apr 23 09:56:10.881103 2026] [:error] [pid 25635:tid 25651] [client 185.92.25.114:45887] [client 185.92.25.114] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "ael8OsRxv6UsgRGKB3L8CgAAAQw"]
[Thu Apr 23 09:56:12.862137 2026] [:error] [pid 64998:tid 65017] [client 185.192.71.38:49179] [client 185.192.71.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "ael8PIV5EysYcTLjmwh9WgAAAc8"]
[Thu Apr 23 09:56:13.739900 2026] [:error] [pid 59700:tid 59723] [client 91.230.225.208:22059] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "ael8PZXyGZJFeAIDWtmV9gAAAVU"]
[Thu Apr 23 09:56:15.690342 2026] [:error] [pid 59700:tid 59723] [client 185.192.71.23:29451] [client 185.192.71.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "ael8P5XyGZJFeAIDWtmWBAAAAVU"]
[Thu Apr 23 09:56:16.813062 2026] [:error] [pid 25635:tid 25639] [client 185.192.71.33:42655] [client 185.192.71.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "ael8QMRxv6UsgRGKB3L8PgAAAQA"]
[Thu Apr 23 09:56:25.476303 2026] [:error] [pid 59700:tid 59703] [client 91.230.225.199:37591] [client 91.230.225.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "ael8SZXyGZJFeAIDWtmWVQAAAUE"]
[Thu Apr 23 09:56:26.020121 2026] [:error] [pid 42971:tid 43004] [client 91.230.225.14:46223] [client 91.230.225.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "ael8SjEP2_5RswrH8bHdYwAAABI"]
[Thu Apr 23 09:56:28.542533 2026] [:error] [pid 64998:tid 65010] [client 91.230.225.196:34495] [client 91.230.225.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "ael8TIV5EysYcTLjmwh_GAAAAcg"]
[Thu Apr 23 09:56:29.091001 2026] [:error] [pid 65000:tid 65055] [client 185.192.71.30:22723] [client 185.192.71.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "ael8Tb6vRb9j6psK2ZYCIQAAAhY"]
[Thu Apr 23 09:56:30.180387 2026] [:error] [pid 65000:tid 65046] [client 185.192.71.26:41931] [client 185.192.71.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "ael8Tr6vRb9j6psK2ZYCQwAAAg0"]
[Thu Apr 23 09:56:30.715878 2026] [:error] [pid 64998:tid 65023] [client 91.230.225.206:38725] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "ael8ToV5EysYcTLjmwh_WgAAAdU"]
[Thu Apr 23 09:56:31.295882 2026] [:error] [pid 42971:tid 42990] [client 91.230.225.208:28429] [client 91.230.225.208] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.208, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "ael8TzEP2_5RswrH8bHdgwAAAAQ"]
[Thu Apr 23 09:56:31.338486 2026] [proxy_fcgi:error] [pid 42971:tid 42990] [client 91.230.225.208:28429] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:56:31.616736 2026] [:error] [pid 42971:tid 43005] [client 91.230.225.208:28429] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "ael8TzEP2_5RswrH8bHdiAAAABM"]
[Thu Apr 23 09:56:32.779731 2026] [:error] [pid 65000:tid 65053] [client 91.230.225.22:26421] [client 91.230.225.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "ael8UL6vRb9j6psK2ZYCbwAAAhQ"]
[Thu Apr 23 09:56:33.357675 2026] [:error] [pid 42972:tid 43040] [client 185.192.71.28:39567] [client 185.192.71.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/network.php"] [unique_id "ael8UcOAb-3sOknsk4dG9gAAAFg"]
[Thu Apr 23 09:56:35.872180 2026] [:error] [pid 25635:tid 25646] [client 185.192.71.26:31535] [client 185.192.71.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "ael8U8Rxv6UsgRGKB3L9eAAAAQc"]
[Thu Apr 23 09:56:36.403197 2026] [:error] [pid 42972:tid 43018] [client 91.230.225.206:46793] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "ael8VMOAb-3sOknsk4dHJQAAAEI"]
[Thu Apr 23 09:56:38.637711 2026] [:error] [pid 64998:tid 65013] [client 185.192.71.26:47771] [client 185.192.71.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "ael8VoV5EysYcTLjmwiAFwAAAcs"]
[Thu Apr 23 09:56:39.222384 2026] [:error] [pid 42971:tid 43005] [client 91.230.225.17:24909] [client 91.230.225.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "ael8VzEP2_5RswrH8bHdsgAAABM"]
[Thu Apr 23 09:56:39.765596 2026] [proxy_fcgi:error] [pid 64998:tid 65002] [client 91.230.225.209:44673] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:56:40.036948 2026] [:error] [pid 64998:tid 65009] [client 91.230.225.209:44673] [client 91.230.225.209] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.230.225.209, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "ael8WIV5EysYcTLjmwiAOQAAAcc"]
[Thu Apr 23 09:56:40.609639 2026] [:error] [pid 64998:tid 65007] [client 91.230.225.209:44673] [client 91.230.225.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "ael8WIV5EysYcTLjmwiATAAAAcU"]
[Thu Apr 23 09:56:42.002923 2026] [:error] [pid 42973:tid 43044] [client 91.230.225.204:53927] [client 91.230.225.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "ael8Wm6I0QqmmmLTHE30xgAAAIE"]
[Thu Apr 23 09:56:42.548403 2026] [:error] [pid 59700:tid 59714] [client 91.230.225.17:58623] [client 91.230.225.17] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ws.php"] [unique_id "ael8WpXyGZJFeAIDWtmW1AAAAUw"]
[Thu Apr 23 09:56:43.400519 2026] [:error] [pid 64998:tid 65021] [client 91.230.225.21:25927] [client 91.230.225.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "ael8W4V5EysYcTLjmwiAgwAAAdM"]
[Thu Apr 23 09:56:43.941950 2026] [:error] [pid 43083:tid 43107] [client 91.230.225.18:46777] [client 91.230.225.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "ael8WzC5hrvNXosL83IZ8QAAANY"]
[Thu Apr 23 09:56:45.334365 2026] [:error] [pid 42973:tid 43058] [client 91.230.225.23:30907] [client 91.230.225.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "ael8XW6I0QqmmmLTHE304gAAAI8"]
[Thu Apr 23 09:56:46.418796 2026] [:error] [pid 59700:tid 59719] [client 91.230.225.13:43663] [client 91.230.225.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "ael8XpXyGZJFeAIDWtmW6gAAAVE"]
[Thu Apr 23 09:56:48.061814 2026] [:error] [pid 64998:tid 65017] [client 91.230.225.11:47655] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "ael8YIV5EysYcTLjmwiA5wAAAc8"]
[Thu Apr 23 09:56:48.619303 2026] [:error] [pid 43083:tid 43093] [client 91.230.225.11:58077] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "ael8YDC5hrvNXosL83IaMwAAAMg"]
[Thu Apr 23 09:56:50.442291 2026] [:error] [pid 42971:tid 42999] [client 91.230.225.14:46279] [client 91.230.225.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/count.php"] [unique_id "ael8YjEP2_5RswrH8bHd8QAAAA0"]
[Thu Apr 23 09:56:52.691516 2026] [:error] [pid 59700:tid 59707] [client 91.230.225.207:46511] [client 91.230.225.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "ael8ZJXyGZJFeAIDWtmXGAAAAUU"]
[Thu Apr 23 09:56:53.806942 2026] [:error] [pid 65000:tid 65038] [client 91.230.225.198:29547] [client 91.230.225.198] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "paramountestate.com.au"] [uri "/images/stories/themes.php"] [unique_id "ael8Zb6vRb9j6psK2ZYDWAAAAgU"]
[Thu Apr 23 09:56:54.091735 2026] [:error] [pid 65000:tid 65052] [client 91.230.225.198:29547] [client 91.230.225.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "ael8Zr6vRb9j6psK2ZYDWgAAAhM"]
[Thu Apr 23 09:56:56.407085 2026] [:error] [pid 65000:tid 65054] [client 91.230.225.23:20077] [client 91.230.225.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "ael8aL6vRb9j6psK2ZYDcQAAAhU"]
[Thu Apr 23 09:56:56.973644 2026] [:error] [pid 43083:tid 43099] [client 91.230.225.18:61277] [client 91.230.225.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "ael8aDC5hrvNXosL83IauwAAAM4"]
[Thu Apr 23 09:56:59.757105 2026] [:error] [pid 64998:tid 65016] [client 91.230.225.12:53121] [client 91.230.225.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "ael8a4V5EysYcTLjmwiB5wAAAc4"]
[Thu Apr 23 09:57:01.360667 2026] [:error] [pid 65000:tid 65041] [client 91.230.225.13:52111] [client 91.230.225.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "ael8bb6vRb9j6psK2ZYDsgAAAgg"]
[Thu Apr 23 09:57:02.282063 2026] [:error] [pid 64967:tid 64990] [client 185.192.71.23:64497] [client 185.192.71.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "ael8boAV4GfOOdX8Qzo0xgAAAZU"]
[Thu Apr 23 09:57:07.942274 2026] [:error] [pid 25635:tid 25648] [client 91.230.225.19:20029] [client 91.230.225.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "ael8c8Rxv6UsgRGKB3L_DgAAAQk"]
[Thu Apr 23 09:57:09.008018 2026] [:error] [pid 43083:tid 43105] [client 185.192.71.33:26161] [client 185.192.71.33] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/colour.php"] [unique_id "ael8dTC5hrvNXosL83IbfgAAANQ"]
[Thu Apr 23 09:57:09.817292 2026] [:error] [pid 42971:tid 43000] [client 185.192.71.27:49451] [client 185.192.71.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "ael8dTEP2_5RswrH8bHemwAAAA4"]
[Thu Apr 23 09:57:10.353592 2026] [:error] [pid 43083:tid 43107] [client 185.192.71.36:30487] [client 185.192.71.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "ael8djC5hrvNXosL83IboQAAANY"]
[Thu Apr 23 09:57:11.488207 2026] [:error] [pid 65000:tid 65050] [client 91.230.225.196:49271] [client 91.230.225.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "ael8d76vRb9j6psK2ZYEMQAAAhE"]
[Thu Apr 23 09:57:12.622283 2026] [:error] [pid 64998:tid 65006] [client 185.192.71.29:28353] [client 185.192.71.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "ael8eIV5EysYcTLjmwiC0gAAAcQ"]
[Thu Apr 23 09:57:13.192297 2026] [:error] [pid 43083:tid 43094] [client 91.230.225.18:37899] [client 91.230.225.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "ael8eTC5hrvNXosL83IbygAAAMk"]
[Thu Apr 23 09:57:25.451815 2026] [:error] [pid 42972:tid 43030] [client 185.192.71.39:45449] [client 185.192.71.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "ael8hcOAb-3sOknsk4dJowAAAE4"]
[Thu Apr 23 09:57:26.598701 2026] [:error] [pid 42971:tid 42999] [client 91.230.225.11:32937] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "ael8hjEP2_5RswrH8bHfbQAAAA0"]
[Thu Apr 23 09:57:27.975557 2026] [:error] [pid 42972:tid 43018] [client 185.192.71.37:61795] [client 185.192.71.37] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "ael8h8OAb-3sOknsk4dJ8QAAAEI"]
[Thu Apr 23 09:57:28.511867 2026] [:error] [pid 64998:tid 65011] [client 91.230.225.196:61905] [client 91.230.225.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "ael8iIV5EysYcTLjmwiENwAAAck"]
[Thu Apr 23 09:57:29.058336 2026] [:error] [pid 59700:tid 59719] [client 185.192.71.25:46943] [client 185.192.71.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "ael8iZXyGZJFeAIDWtmYzQAAAVE"]
[Thu Apr 23 09:57:30.187549 2026] [:error] [pid 59700:tid 59721] [client 185.192.71.21:65081] [client 185.192.71.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "ael8ipXyGZJFeAIDWtmY5AAAAVM"]
[Thu Apr 23 09:57:31.364186 2026] [:error] [pid 65000:tid 65052] [client 185.192.71.28:25057] [client 185.192.71.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "ael8i76vRb9j6psK2ZYFXQAAAhM"]
[Thu Apr 23 09:57:31.927754 2026] [:error] [pid 43083:tid 43088] [client 91.230.225.206:23345] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "ael8izC5hrvNXosL83Ic7wAAAMM"]
[Thu Apr 23 09:57:32.759133 2026] [:error] [pid 42971:tid 43002] [client 91.230.225.203:39153] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "ael8jDEP2_5RswrH8bHfrgAAABA"]
[Thu Apr 23 09:57:33.321817 2026] [:error] [pid 43083:tid 43109] [client 91.230.225.11:50959] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "ael8jTC5hrvNXosL83IdGgAAANg"]
[Thu Apr 23 09:57:40.840443 2026] [:error] [pid 43083:tid 43088] [client 91.230.225.10:59275] [client 91.230.225.10] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "ael8lDC5hrvNXosL83IdhAAAAMM"]
[Thu Apr 23 09:57:41.681475 2026] [:error] [pid 65000:tid 65045] [client 91.230.225.22:65391] [client 91.230.225.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "ael8lb6vRb9j6psK2ZYGAAAAAgw"]
[Thu Apr 23 09:57:42.235352 2026] [:error] [pid 64998:tid 65018] [client 185.192.71.30:31119] [client 185.192.71.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "ael8loV5EysYcTLjmwiFJwAAAdA"]
[Thu Apr 23 09:57:42.785678 2026] [:error] [pid 59700:tid 59702] [client 91.230.225.207:37831] [client 91.230.225.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "ael8lpXyGZJFeAIDWtmZwgAAAUA"]
[Thu Apr 23 09:57:43.882552 2026] [:error] [pid 25635:tid 25642] [client 185.192.71.32:30215] [client 185.192.71.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "ael8l8Rxv6UsgRGKB3IAdQAAAQM"]
[Thu Apr 23 09:57:45.035558 2026] [:error] [pid 42972:tid 43018] [client 185.192.71.29:41003] [client 185.192.71.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "ael8mcOAb-3sOknsk4dLDgAAAEI"]
[Thu Apr 23 09:57:45.843053 2026] [:error] [pid 43083:tid 43109] [client 91.230.225.16:62879] [client 91.230.225.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "ael8mTC5hrvNXosL83IdxQAAANg"]
[Thu Apr 23 09:57:46.662711 2026] [:error] [pid 43083:tid 43090] [client 91.230.225.18:28737] [client 91.230.225.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "ael8mjC5hrvNXosL83Id1AAAAMU"]
[Thu Apr 23 09:57:50.015435 2026] [:error] [pid 43083:tid 43091] [client 91.230.225.199:25081] [client 91.230.225.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "ael8njC5hrvNXosL83IeCwAAAMY"]
[Thu Apr 23 09:57:50.559696 2026] [:error] [pid 42973:tid 43064] [client 91.230.225.203:53845] [client 91.230.225.203] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "ael8nm6I0QqmmmLTHE330AAAAJU"]
[Thu Apr 23 09:57:51.668821 2026] [:error] [pid 65000:tid 65030] [client 91.230.225.16:49199] [client 91.230.225.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "ael8n76vRb9j6psK2ZYGowAAAgE"]
[Thu Apr 23 09:57:53.419278 2026] [:error] [pid 65000:tid 65032] [client 91.230.225.199:59375] [client 91.230.225.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "ael8ob6vRb9j6psK2ZYG6wAAAgM"]
[Thu Apr 23 09:57:54.564047 2026] [:error] [pid 64998:tid 65013] [client 91.230.225.201:35937] [client 91.230.225.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "ael8ooV5EysYcTLjmwiF7wAAAcs"]
[Thu Apr 23 09:57:55.656593 2026] [:error] [pid 42972:tid 43032] [client 91.230.225.15:59769] [client 91.230.225.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "ael8o8OAb-3sOknsk4dLhQAAAFA"]
[Thu Apr 23 09:57:56.496427 2026] [:error] [pid 64998:tid 65013] [client 91.230.225.195:54519] [client 91.230.225.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "ael8pIV5EysYcTLjmwiGCwAAAcs"]
[Thu Apr 23 09:57:57.352696 2026] [:error] [pid 43083:tid 43105] [client 91.230.225.209:47157] [client 91.230.225.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "ael8pTC5hrvNXosL83IeSgAAANQ"]
[Thu Apr 23 09:57:59.009312 2026] [:error] [pid 42971:tid 42992] [client 91.230.225.20:60411] [client 91.230.225.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "ael8pzEP2_5RswrH8bHhDgAAAAY"]
[Thu Apr 23 09:58:00.415979 2026] [:error] [pid 64998:tid 65015] [client 91.230.225.15:25609] [client 91.230.225.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "ael8qIV5EysYcTLjmwiGOgAAAc0"]
[Thu Apr 23 09:58:00.988303 2026] [proxy_fcgi:error] [pid 42972:tid 43018] [client 185.192.71.39:27317] AH01071: Got error 'Primary script unknown'
[Thu Apr 23 09:58:01.261827 2026] [:error] [pid 42972:tid 43040] [client 185.192.71.39:27317] [client 185.192.71.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "ael8qcOAb-3sOknsk4dLpwAAAFg"]
[Thu Apr 23 09:58:01.826497 2026] [:error] [pid 64998:tid 65005] [client 91.230.225.195:41913] [client 91.230.225.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "ael8qYV5EysYcTLjmwiGUQAAAcM"]
[Thu Apr 23 09:58:03.424822 2026] [:error] [pid 43083:tid 43106] [client 91.230.225.18:63765] [client 91.230.225.18] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ms-users.php"] [unique_id "ael8qzC5hrvNXosL83IegwAAANU"]
[Thu Apr 23 09:58:04.519688 2026] [:error] [pid 43083:tid 43089] [client 185.192.71.38:36665] [client 185.192.71.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "ael8rDC5hrvNXosL83IelAAAAMQ"]
[Thu Apr 23 09:58:05.069653 2026] [:error] [pid 42973:tid 43052] [client 185.192.71.26:63355] [client 185.192.71.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "ael8rW6I0QqmmmLTHE34WQAAAIk"]
[Thu Apr 23 09:58:08.348761 2026] [:error] [pid 65000:tid 65056] [client 185.192.71.35:57743] [client 185.192.71.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "ael8sL6vRb9j6psK2ZYHqQAAAhc"]
[Thu Apr 23 09:58:08.926570 2026] [:error] [pid 42972:tid 43038] [client 91.230.225.206:50399] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "ael8sMOAb-3sOknsk4dMAwAAAFY"]
[Thu Apr 23 09:58:10.746328 2026] [:error] [pid 25635:tid 25650] [client 91.230.225.200:34661] [client 91.230.225.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/log.php"] [unique_id "ael8ssRxv6UsgRGKB3IB3wAAAQs"]
[Thu Apr 23 09:58:11.286619 2026] [:error] [pid 65000:tid 65030] [client 185.192.71.32:37867] [client 185.192.71.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "ael8s76vRb9j6psK2ZYHvwAAAgE"]
[Thu Apr 23 09:58:11.820827 2026] [:error] [pid 59700:tid 59705] [client 185.192.71.21:59241] [client 185.192.71.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "ael8s5XyGZJFeAIDWtma8AAAAUM"]
[Thu Apr 23 09:58:12.355613 2026] [:error] [pid 25635:tid 25644] [client 91.230.225.20:21447] [client 91.230.225.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/aw.php"] [unique_id "ael8tMRxv6UsgRGKB3ICAwAAAQU"]
[Thu Apr 23 09:58:14.022950 2026] [:error] [pid 43083:tid 43108] [client 185.192.71.36:57989] [client 185.192.71.36] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "ael8tjC5hrvNXosL83IfJQAAANc"]
[Thu Apr 23 09:58:14.553502 2026] [:error] [pid 43083:tid 43102] [client 91.230.225.198:35769] [client 91.230.225.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "ael8tjC5hrvNXosL83IfKQAAANE"]
[Thu Apr 23 09:58:15.644134 2026] [:error] [pid 43083:tid 43108] [client 91.230.225.208:46663] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "ael8tzC5hrvNXosL83IfMgAAANc"]
[Thu Apr 23 09:58:16.199722 2026] [:error] [pid 42972:tid 43027] [client 91.230.225.202:55859] [client 91.230.225.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "ael8uMOAb-3sOknsk4dMPQAAAEs"]
[Thu Apr 23 09:58:17.322251 2026] [:error] [pid 59700:tid 59706] [client 91.230.225.17:40689] [client 91.230.225.17] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "ael8uZXyGZJFeAIDWtmbIwAAAUQ"]
[Thu Apr 23 09:58:17.887578 2026] [:error] [pid 42972:tid 43037] [client 91.230.225.200:31227] [client 91.230.225.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "ael8ucOAb-3sOknsk4dMXgAAAFU"]
[Thu Apr 23 09:58:20.364170 2026] [:error] [pid 64967:tid 64988] [client 185.192.71.38:61581] [client 185.192.71.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "ael8vIAV4GfOOdX8Qzo3hgAAAZM"]
[Thu Apr 23 09:58:20.920518 2026] [:error] [pid 64967:tid 64971] [client 185.192.71.24:35537] [client 185.192.71.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "ael8vIAV4GfOOdX8Qzo3jQAAAYI"]
[Thu Apr 23 09:58:22.024395 2026] [:error] [pid 43083:tid 43104] [client 185.192.71.21:59141] [client 185.192.71.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/file.php"] [unique_id "ael8vjC5hrvNXosL83IfkwAAANM"]
[Thu Apr 23 09:58:22.843784 2026] [:error] [pid 65000:tid 65050] [client 91.230.225.20:50567] [client 91.230.225.20] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "ael8vr6vRb9j6psK2ZYIJgAAAhE"]
[Thu Apr 23 09:58:23.662695 2026] [:error] [pid 59700:tid 59721] [client 185.192.71.38:25151] [client 185.192.71.38] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/load.php"] [unique_id "ael8v5XyGZJFeAIDWtmbmAAAAVM"]
[Thu Apr 23 09:58:25.358893 2026] [:error] [pid 65000:tid 65042] [client 91.230.225.208:30749] [client 91.230.225.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "ael8wb6vRb9j6psK2ZYIZAAAAgk"]
[Thu Apr 23 09:58:25.900540 2026] [:error] [pid 25635:tid 25652] [client 91.230.225.197:41281] [client 91.230.225.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "ael8wcRxv6UsgRGKB3ICqgAAAQ0"]
[Thu Apr 23 09:58:27.271711 2026] [:error] [pid 43083:tid 43108] [client 91.230.225.199:37329] [client 91.230.225.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "ael8wzC5hrvNXosL83IfxwAAANc"]
[Thu Apr 23 09:58:28.099511 2026] [:error] [pid 43083:tid 43090] [client 91.230.225.205:28195] [client 91.230.225.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "ael8xDC5hrvNXosL83If1AAAAMU"]
[Thu Apr 23 09:58:29.219047 2026] [:error] [pid 43083:tid 43094] [client 91.230.225.205:40355] [client 91.230.225.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "ael8xTC5hrvNXosL83If5AAAAMk"]
[Thu Apr 23 09:58:29.750430 2026] [:error] [pid 42973:tid 43059] [client 91.230.225.195:57259] [client 91.230.225.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "ael8xW6I0QqmmmLTHE35VQAAAJA"]
[Thu Apr 23 09:58:30.284378 2026] [:error] [pid 43083:tid 43089] [client 91.230.225.21:42681] [client 91.230.225.21] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "ael8xjC5hrvNXosL83If6QAAAMQ"]
[Thu Apr 23 09:58:33.127700 2026] [:error] [pid 25635:tid 25651] [client 185.192.71.23:51545] [client 185.192.71.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "ael8ycRxv6UsgRGKB3IDRQAAAQw"]
[Thu Apr 23 09:58:34.939735 2026] [:error] [pid 42973:tid 43061] [client 91.230.225.15:25589] [client 91.230.225.15] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "ael8ym6I0QqmmmLTHE35vQAAAJI"]
[Thu Apr 23 09:58:36.067140 2026] [:error] [pid 64998:tid 65014] [client 91.230.225.206:44191] [client 91.230.225.206] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "ael8zIV5EysYcTLjmwiIYgAAAcw"]
[Thu Apr 23 09:58:36.655349 2026] [:error] [pid 65000:tid 65048] [client 91.230.225.13:52015] [client 91.230.225.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "ael8zL6vRb9j6psK2ZYI5QAAAg8"]
[Thu Apr 23 09:58:37.196146 2026] [:error] [pid 64998:tid 65013] [client 91.230.225.12:43567] [client 91.230.225.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "ael8zYV5EysYcTLjmwiIcQAAAcs"]
[Thu Apr 23 09:58:42.267287 2026] [:error] [pid 25635:tid 25651] [client 91.230.225.11:31951] [client 91.230.225.11] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ael80sRxv6UsgRGKB3IDzgAAAQw"]
[Thu Apr 23 09:58:44.844652 2026] [:error] [pid 43083:tid 43089] [client 185.192.71.32:41685] [client 185.192.71.32] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ms-pie.php"] [unique_id "ael81DC5hrvNXosL83IgkwAAAMQ"]
[Thu Apr 23 09:58:46.562326 2026] [:error] [pid 64998:tid 65017] [client 91.230.225.200:25117] [client 91.230.225.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "ael81oV5EysYcTLjmwiJCwAAAc8"]
[Thu Apr 23 09:58:47.666045 2026] [:error] [pid 42972:tid 43027] [client 185.192.71.35:62605] [client 185.192.71.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/nav-menu.php"] [unique_id "ael818OAb-3sOknsk4dNagAAAEs"]
[Thu Apr 23 09:58:48.197656 2026] [:error] [pid 25635:tid 25642] [client 91.230.225.12:21289] [client 91.230.225.12] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/user.php"] [unique_id "ael82MRxv6UsgRGKB3IEBQAAAQM"]
[Thu Apr 23 09:58:52.945453 2026] [:error] [pid 64967:tid 64988] [client 91.230.225.16:26721] [client 91.230.225.16] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "ael83IAV4GfOOdX8Qzo46wAAAZM"]
[Thu Apr 23 09:58:53.484912 2026] [:error] [pid 42973:tid 43065] [client 185.192.71.26:48705] [client 185.192.71.26] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "ael83W6I0QqmmmLTHE36xQAAAJY"]
[Thu Apr 23 09:58:54.031638 2026] [:error] [pid 65000:tid 65047] [client 91.230.225.23:46683] [client 91.230.225.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "ael83r6vRb9j6psK2ZYJZwAAAg4"]
[Thu Apr 23 09:58:54.842734 2026] [:error] [pid 64967:tid 64986] [client 185.192.71.31:32391] [client 185.192.71.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.192.71.31, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "ael83oAV4GfOOdX8Qzo5GwAAAZE"]
[Thu Apr 23 09:58:55.387620 2026] [:error] [pid 64967:tid 64974] [client 185.192.71.31:32391] [client 185.192.71.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "ael834AV4GfOOdX8Qzo5KAAAAYU"]
[Thu Apr 23 09:58:55.936032 2026] [:error] [pid 65000:tid 65043] [client 91.230.225.207:25723] [client 91.230.225.207] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "ael8376vRb9j6psK2ZYJcQAAAgo"]
[Thu Apr 23 09:58:56.480143 2026] [:error] [pid 64998:tid 65015] [client 91.230.225.24:62443] [client 91.230.225.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "ael84IV5EysYcTLjmwiJngAAAc0"]
[Thu Apr 23 09:58:58.688394 2026] [:error] [pid 59700:tid 59705] [client 91.230.225.197:22797] [client 91.230.225.197] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "ael84pXyGZJFeAIDWtmc1wAAAUM"]
[Thu Apr 23 09:59:02.209314 2026] [:error] [pid 42971:tid 43001] [client 91.230.225.204:57365] [client 91.230.225.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "ael85jEP2_5RswrH8bHjSAAAAA8"]
[Thu Apr 23 09:59:03.292801 2026] [:error] [pid 64998:tid 65012] [client 185.192.71.28:38937] [client 185.192.71.28] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "ael854V5EysYcTLjmwiKGwAAAco"]
[Thu Apr 23 09:59:07.307690 2026] [:error] [pid 42971:tid 42993] [client 91.230.225.24:57235] [client 91.230.225.24] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "ael86zEP2_5RswrH8bHjeAAAAAc"]
[Thu Apr 23 09:59:07.857035 2026] [:error] [pid 43083:tid 43086] [client 91.230.225.22:50601] [client 91.230.225.22] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "ael86zC5hrvNXosL83IhGAAAAME"]
[Thu Apr 23 09:59:08.398118 2026] [:error] [pid 43083:tid 43094] [client 185.192.71.39:42411] [client 185.192.71.39] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/mer_gagal.php"] [unique_id "ael87DC5hrvNXosL83IhHgAAAMk"]
[Thu Apr 23 09:59:08.944033 2026] [:error] [pid 64998:tid 65007] [client 185.192.71.27:22225] [client 185.192.71.27] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "ael87IV5EysYcTLjmwiKSgAAAcU"]
[Thu Apr 23 09:59:10.291505 2026] [:error] [pid 43083:tid 43085] [client 91.230.225.19:55069] [client 91.230.225.19] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "ael87jC5hrvNXosL83IhPgAAAMA"]
[Thu Apr 23 09:59:10.831431 2026] [:error] [pid 64967:tid 64971] [client 185.192.71.31:43911] [client 185.192.71.31] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "ael87oAV4GfOOdX8Qzo54AAAAYI"]
[Thu Apr 23 09:59:12.750773 2026] [:error] [pid 25635:tid 25648] [client 185.192.71.25:42691] [client 185.192.71.25] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "ael88MRxv6UsgRGKB3IElgAAAQk"]
[Thu Apr 23 09:59:14.391035 2026] [:error] [pid 64967:tid 64973] [client 185.192.71.29:22611] [client 185.192.71.29] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "ael88oAV4GfOOdX8Qzo6GAAAAYQ"]
[Thu Apr 23 09:59:14.950808 2026] [:error] [pid 25635:tid 25645] [client 91.230.225.23:55329] [client 91.230.225.23] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "ael88sRxv6UsgRGKB3IErAAAAQY"]
[Thu Apr 23 09:59:44.198324 2026] [autoindex:error] [pid 65000:tid 65051] [client 185.192.71.40:65507] AH01276: Cannot serve directory /usr/local/apache/autossl_tmp/.well-known/acme-challenge/: No matching DirectoryIndex (index.php,index.html.var,index.htm,index.html,index.shtml,index.xhtml,index.wml,index.perl,index.pl,index.plx,index.ppl,index.cgi,index.jsp,index.js,index.jp,index.php4,index.php3,index.phtml,default.htm,default.html,home.htm,index.php5,Default.html,Default.htm,home.html) found, and server-generated directory index forbidden by Options directive
[Thu Apr 23 23:08:16.849091 2026] [:error] [pid 64998:tid 65005] [client 172.161.0.169:14980] [client 172.161.0.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "www.paramountestate.com.au"] [uri "/tiny.php"] [unique_id "aeo14IV5EysYcTLjmwiuWQAAAcM"]
[Thu Apr 23 23:08:35.489418 2026] [:error] [pid 65000:tid 65054] [client 172.161.0.169:18718] [client 172.161.0.169] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aeo1876vRb9j6psK2ZbQngAAAhU"]
[Fri Apr 24 00:37:50.226309 2026] [:error] [pid 65000:tid 65031] [client 103.215.237.25:63849] [client 103.215.237.25] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.215.237.25, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aepK3r6vRb9j6psK2ZYtIAAAAgI"]
[Fri Apr 24 01:23:50.165874 2026] [:error] [pid 64998:tid 65010] [client 158.158.100.100:57598] [client 158.158.100.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "aepVpoV5EysYcTLjmwghbgAAAcg"]
[Fri Apr 24 01:24:09.579809 2026] [:error] [pid 43083:tid 43098] [client 158.158.100.100:36019] [client 158.158.100.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "aepVuTC5hrvNXosL83Kn-gAAAM0"]
[Fri Apr 24 02:55:02.081685 2026] [:error] [pid 42972:tid 43021] [client 146.70.240.214:36738] [client 146.70.240.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 146.70.240.214, counter = 54"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aeprBsOAb-3sOknsk4fZ3gAAAEU"]
[Fri Apr 24 02:55:07.280569 2026] [:error] [pid 64998:tid 65016] [client 146.70.240.214:49530] [client 146.70.240.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 146.70.240.214, counter = 54"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aeprC4V5EysYcTLjmwhQ9AAAAc4"]
[Fri Apr 24 03:15:13.241076 2026] [:error] [pid 25635:tid 25659] [client 74.248.129.192:64469] [client 74.248.129.192] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aepvwcRxv6UsgRGKB3JY1AAAARQ"]
[Fri Apr 24 03:31:44.114078 2026] [:error] [pid 25635:tid 25647] [client 34.74.51.36:58802] [client 34.74.51.36] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aepzoMRxv6UsgRGKB3Ja8QAAAQg"]
[Fri Apr 24 13:36:49.934454 2026] [:error] [pid 17721:tid 17804] [client 146.70.240.214:35418] [client 146.70.240.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 146.70.240.214, counter = 14"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aesBceFXXkLeyDnfk__AgwAAABc"]
[Fri Apr 24 15:59:59.661620 2026] [:error] [pid 17808:tid 17812] [client 202.57.30.210:58584] [client 202.57.30.210] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 202.57.30.210, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aesi_-arbOEFI8qshvLEtgAAAEI"]
[Fri Apr 24 16:17:25.862245 2026] [:error] [pid 17720:tid 17766] [client 104.28.161.163:27391] [client 104.28.161.163] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/style.php"] [unique_id "aesnFehlUs6BS3Ng7_UgcwAAAMw"]
[Fri Apr 24 19:36:01.049347 2026] [:error] [pid 17720:tid 17758] [client 20.107.212.3:12890] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aetVoehlUs6BS3Ng7_WIewAAAMQ"]
[Fri Apr 24 19:36:01.593334 2026] [:error] [pid 14531:tid 14534] [client 20.107.212.3:10624] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aetVoXfLU2gw-6KR-Ga3CwAAAUE"]
[Fri Apr 24 19:36:02.163098 2026] [:error] [pid 4177:tid 4208] [client 20.107.212.3:13019] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aetVon2asKnvdrSe0x7i8AAAAZc"]
[Fri Apr 24 19:36:02.723805 2026] [:error] [pid 17808:tid 17832] [client 20.107.212.3:10758] [client 20.107.212.3] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hellopress/wp_filemanager.php"] [unique_id "aetVouarbOEFI8qshvIgcwAAAFY"]
[Fri Apr 24 23:01:56.290469 2026] [:error] [pid 4177:tid 4194] [client 20.46.120.13:3796] [client 20.46.120.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.46.120.13, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aeuF5H2asKnvdrSe0x5YmgAAAYk"]
[Fri Apr 24 23:01:57.383404 2026] [:error] [pid 4177:tid 4200] [client 20.46.120.13:3796] [client 20.46.120.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.46.120.13, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aeuF5X2asKnvdrSe0x5YpgAAAY8"]
[Fri Apr 24 23:01:58.916725 2026] [:error] [pid 4177:tid 4196] [client 20.46.120.13:3796] [client 20.46.120.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aeuF5n2asKnvdrSe0x5YsgAAAYs"]
[Sat Apr 25 01:50:38.005988 2026] [:error] [pid 42852:tid 42875] [client 155.248.183.67:59091] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aeutbjMEwxhhak_EhMKgZgAAAlQ"]
[Sat Apr 25 01:50:39.236597 2026] [:error] [pid 42852:tid 42879] [client 155.248.183.67:60325] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aeutbzMEwxhhak_EhMKgbQAAAlg"]
[Sat Apr 25 01:50:39.464055 2026] [:error] [pid 14989:tid 14999] [client 155.248.183.67:57381] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aeutb3hRYjsAsZTO4EOpfgAAAAg"]
[Sat Apr 25 01:50:40.692313 2026] [:error] [pid 14989:tid 14992] [client 155.248.183.67:59819] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aeutcHhRYjsAsZTO4EOphQAAAAE"]
[Sat Apr 25 01:50:41.921105 2026] [:error] [pid 42755:tid 42759] [client 155.248.183.67:60597] [client 155.248.183.67] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "aeutcdH7__k0j6aa600LnwAAAII"]
[Sat Apr 25 10:14:57.098553 2026] [:error] [pid 46083:tid 46101] [client 184.181.36.192:59617] [client 184.181.36.192] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 184.181.36.192, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aewjoTxw_Zq74vWdjmmfBQAAAQ4"]
[Sat Apr 25 10:55:48.845037 2026] [:error] [pid 44321:tid 44389] [client 45.71.146.3:30688] [client 45.71.146.3] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.71.146.3, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aewtNI1b5lV-asWa_Y5rvAAAAIY"]
[Sat Apr 25 11:43:20.661930 2026] [proxy_fcgi:error] [pid 44425:tid 44431] [client 20.46.120.13:5063] AH01071: Got error 'Primary script unknown'
[Sat Apr 25 11:43:30.159812 2026] [:error] [pid 44425:tid 44433] [client 20.46.120.13:5063] [client 20.46.120.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.46.120.13, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/images/wp-login.php"] [unique_id "aew4YiUl-VlItvY2tR9wLQAAAMY"]
[Sat Apr 25 23:26:43.970862 2026] [:error] [pid 3212:tid 3236] [client 146.70.240.214:38606] [client 146.70.240.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 146.70.240.214, counter = 28"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aezdM_g-28TY8_YLtUd1hAAAARY"]
[Sat Apr 25 23:39:41.948115 2026] [:error] [pid 59896:tid 59904] [client 20.199.101.230:48175] [client 20.199.101.230] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "aezgPbLLzhtkd-OXUgApBwAAAEQ"]
[Sat Apr 25 23:48:37.433456 2026] [:error] [pid 3212:tid 3237] [client 74.249.155.150:6452] [client 74.249.155.150] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 74.249.155.150, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "aeziVfg-28TY8_YLtUeDZwAAARc"]
[Sat Apr 25 23:48:43.022131 2026] [:error] [pid 3212:tid 3229] [client 74.249.155.150:6452] [client 74.249.155.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "aeziW_g-28TY8_YLtUeDfwAAAQ8"]
[Sat Apr 25 23:48:46.739460 2026] [:error] [pid 59985:tid 60002] [client 74.249.155.150:6430] [client 74.249.155.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "aeziXgF_zDvEhKvyTH7duwAAAA8"]
[Sat Apr 25 23:48:48.466417 2026] [:error] [pid 59985:tid 59993] [client 74.249.155.150:6426] [client 74.249.155.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "aeziYAF_zDvEhKvyTH7dwwAAAAY"]
[Sat Apr 25 23:48:52.163520 2026] [:error] [pid 59896:tid 59923] [client 74.249.155.150:6415] [client 74.249.155.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "aeziZLLLzhtkd-OXUgAs8QAAAFc"]
[Sun Apr 26 05:28:11.269372 2026] [:error] [pid 41906:tid 41923] [client 212.8.249.216:9251] [client 212.8.249.216] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 212.8.249.216, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ae0x6z3-0A3lxw9OXoD5gwAAAY8"]
[Sun Apr 26 05:58:19.316836 2026] [:error] [pid 8390:tid 8459] [client 206.81.6.43:60252] [client 206.81.6.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.6.43, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ae04-4GPtFK_i9p5yxQVwAAAAIg"]
[Sun Apr 26 05:58:20.175788 2026] [:error] [pid 41906:tid 41929] [client 206.81.6.43:57222] [client 206.81.6.43] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 206.81.6.43, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ae04_D3-0A3lxw9OXoAYLAAAAZU"]
[Sun Apr 26 06:02:45.121030 2026] [:error] [pid 8491:tid 8501] [client 212.47.78.126:54602] [client 212.47.78.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ae06BSq7I7e6CJooQM2T_wAAAMI"]
[Sun Apr 26 06:02:45.919697 2026] [:error] [pid 41906:tid 41926] [client 212.47.78.126:62234] [client 212.47.78.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ae06BT3-0A3lxw9OXoAbvgAAAZI"]
[Sun Apr 26 06:02:46.526245 2026] [:error] [pid 8390:tid 8461] [client 212.47.78.126:59349] [client 212.47.78.126] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/media/system/js/core.js"] [unique_id "ae06BoGPtFK_i9p5yxQWdgAAAIo"]
[Sun Apr 26 11:39:15.779913 2026] [:error] [pid 13137:tid 13146] [client 146.70.240.214:42452] [client 146.70.240.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 146.70.240.214, counter = 14"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ae2I490RB4J0o4h5neEfEgAAAgY"]
[Sun Apr 26 13:10:10.701132 2026] [:error] [pid 8491:tid 8508] [client 154.58.229.82:59754] [client 154.58.229.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "ae2eMiq7I7e6CJooQM3XWQAAAMk"]
[Sun Apr 26 13:10:11.354019 2026] [:error] [pid 8390:tid 8463] [client 154.58.229.82:59810] [client 154.58.229.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.local"] [unique_id "ae2eM4GPtFK_i9p5yxTKmwAAAIw"]
[Sun Apr 26 13:10:11.358769 2026] [:error] [pid 8390:tid 8454] [client 154.58.229.82:59770] [client 154.58.229.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-config.php"] [unique_id "ae2eM4GPtFK_i9p5yxTKnAAAAIM"]
[Sun Apr 26 13:10:11.362436 2026] [:error] [pid 8390:tid 8473] [client 154.58.229.82:59802] [client 154.58.229.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.old"] [unique_id "ae2eM4GPtFK_i9p5yxTKnQAAAJY"]
[Sun Apr 26 13:10:11.365627 2026] [:error] [pid 22573:tid 22622] [client 154.58.229.82:59840] [client 154.58.229.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production"] [unique_id "ae2eM3B3EmQlD4yKUt-VeQAAAY8"]
[Sun Apr 26 13:10:11.405030 2026] [:error] [pid 22573:tid 22610] [client 154.58.229.82:59844] [client 154.58.229.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.bak"] [unique_id "ae2eM3B3EmQlD4yKUt-VewAAAYQ"]
[Sun Apr 26 13:10:11.405289 2026] [:error] [pid 22572:tid 22591] [client 154.58.229.82:59846] [client 154.58.229.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-config.php.bak"] [unique_id "ae2eM9XOViWCFU-pZzDSpgAAAU0"]
[Sun Apr 26 13:10:11.542396 2026] [:error] [pid 22573:tid 22625] [client 154.58.229.82:59858] [client 154.58.229.82] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "ae2eM3B3EmQlD4yKUt-VfAAAAZI"]
[Sun Apr 26 21:24:28.226903 2026] [:error] [pid 22572:tid 22600] [client 108.68.147.51:4763] [client 108.68.147.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ae4SDNXOViWCFU-pZzA1PQAAAVY"]
[Sun Apr 26 22:51:15.237808 2026] [:error] [pid 8385:tid 8433] [client 20.219.12.30:6527] [client 20.219.12.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.12.30, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ae4mYzOy7_J84Wx3-ozkqQAAAEk"]
[Sun Apr 26 22:51:16.548402 2026] [:error] [pid 8385:tid 8428] [client 20.219.12.30:6527] [client 20.219.12.30] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.219.12.30, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ae4mZDOy7_J84Wx3-ozkswAAAEQ"]
[Sun Apr 26 22:51:18.289693 2026] [:error] [pid 8385:tid 8440] [client 20.219.12.30:6527] [client 20.219.12.30] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ae4mZjOy7_J84Wx3-ozkvwAAAFA"]
[Mon Apr 27 02:14:12.331604 2026] [:error] [pid 8491:tid 8502] [client 102.208.148.69:49621] [client 102.208.148.69] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.208.148.69, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ae5V9Cq7I7e6CJooQM08ogAAAMM"]
[Mon Apr 27 03:46:15.914136 2026] [:error] [pid 20157:tid 20205] [client 89.163.146.197:54998] [client 89.163.146.197] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/txets.php"] [unique_id "ae5rh2PFY5ruac1JAaNtXwAAAAA"], referer: www.google.com
[Mon Apr 27 05:35:00.613791 2026] [:error] [pid 22751:tid 22761] [client 20.48.152.115:62585] [client 20.48.152.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "ae6FBCc0tCpVyVdFok-gdAAAAMc"]
[Mon Apr 27 05:35:20.078661 2026] [:error] [pid 22645:tid 22671] [client 20.48.152.115:62495] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gmo.php"] [unique_id "ae6FGH-Pq2r302zQbMaf2QAAABA"]
[Mon Apr 27 05:35:20.494660 2026] [:error] [pid 22647:tid 22720] [client 20.48.152.115:62507] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gmo.php"] [unique_id "ae6FGGjfVULTjnk5SzORwgAAAIo"]
[Mon Apr 27 05:35:20.930349 2026] [:error] [pid 22751:tid 22778] [client 20.48.152.115:62578] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gmo.php"] [unique_id "ae6FGCc0tCpVyVdFok-hRwAAANg"]
[Mon Apr 27 05:35:21.343844 2026] [:error] [pid 22646:tid 22704] [client 20.48.152.115:58446] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gmo.php"] [unique_id "ae6FGYk_HyZhTP6AYaeF3gAAAFU"]
[Mon Apr 27 05:35:21.916956 2026] [:error] [pid 22751:tid 22760] [client 20.48.152.115:62468] [client 20.48.152.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ae6FGSc0tCpVyVdFok-hUQAAAMY"]
[Mon Apr 27 05:35:22.342783 2026] [:error] [pid 22751:tid 22776] [client 20.48.152.115:62514] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css/index.php"] [unique_id "ae6FGic0tCpVyVdFok-hWQAAANY"]
[Mon Apr 27 05:35:22.755125 2026] [:error] [pid 22751:tid 22763] [client 20.48.152.115:62481] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css/index.php"] [unique_id "ae6FGic0tCpVyVdFok-hWwAAAMk"]
[Mon Apr 27 05:35:23.204431 2026] [:error] [pid 22646:tid 22689] [client 20.48.152.115:58445] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css/index.php"] [unique_id "ae6FG4k_HyZhTP6AYaeF6wAAAEY"]
[Mon Apr 27 05:35:23.685344 2026] [:error] [pid 22751:tid 22766] [client 20.48.152.115:62582] [client 20.48.152.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "ae6FGyc0tCpVyVdFok-hYgAAAMw"]
[Mon Apr 27 05:35:24.192408 2026] [:error] [pid 22646:tid 22701] [client 20.48.152.115:62487] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "ae6FHIk_HyZhTP6AYaeF9AAAAFI"]
[Mon Apr 27 05:35:24.631889 2026] [:error] [pid 22646:tid 22691] [client 20.48.152.115:58442] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "ae6FHIk_HyZhTP6AYaeF9gAAAEg"]
[Mon Apr 27 05:35:25.050628 2026] [:error] [pid 22647:tid 22713] [client 20.48.152.115:62570] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "ae6FHWjfVULTjnk5SzOR6QAAAIM"]
[Mon Apr 27 05:35:25.467816 2026] [:error] [pid 22647:tid 22718] [client 20.48.152.115:62527] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "ae6FHWjfVULTjnk5SzOR8AAAAIg"]
[Mon Apr 27 05:35:26.107559 2026] [:error] [pid 22645:tid 22671] [client 20.48.152.115:58440] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filemanager/dialog.php"] [unique_id "ae6FHn-Pq2r302zQbMaf4wAAABA"]
[Mon Apr 27 05:35:26.533979 2026] [:error] [pid 22647:tid 22720] [client 20.48.152.115:58447] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filemanager/dialog.php"] [unique_id "ae6FHmjfVULTjnk5SzOSAQAAAIo"]
[Mon Apr 27 05:35:26.965690 2026] [:error] [pid 22646:tid 22694] [client 20.48.152.115:62506] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filemanager/dialog.php"] [unique_id "ae6FHok_HyZhTP6AYaeGBAAAAEs"]
[Mon Apr 27 05:35:27.389920 2026] [:error] [pid 22647:tid 22714] [client 20.48.152.115:62565] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/filemanager/dialog.php"] [unique_id "ae6FH2jfVULTjnk5SzOSCwAAAIQ"]
[Mon Apr 27 05:35:27.873698 2026] [:error] [pid 22751:tid 22754] [client 20.48.152.115:62485] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ae6FHyc0tCpVyVdFok-hfwAAAME"]
[Mon Apr 27 05:35:28.291383 2026] [:error] [pid 22647:tid 22722] [client 20.48.152.115:58444] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ae6FIGjfVULTjnk5SzOSEgAAAIw"]
[Mon Apr 27 05:35:28.732844 2026] [:error] [pid 22647:tid 22718] [client 20.48.152.115:58434] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ae6FIGjfVULTjnk5SzOSGAAAAIg"]
[Mon Apr 27 05:35:29.156583 2026] [:error] [pid 22646:tid 22703] [client 20.48.152.115:58436] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ae6FIYk_HyZhTP6AYaeGDwAAAFQ"]
[Mon Apr 27 05:35:29.567737 2026] [:error] [pid 22751:tid 22754] [client 20.48.152.115:58375] [client 20.48.152.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "ae6FISc0tCpVyVdFok-hkQAAAME"]
[Mon Apr 27 05:35:29.999777 2026] [:error] [pid 22751:tid 22763] [client 20.48.152.115:58435] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/index/function.php"] [unique_id "ae6FISc0tCpVyVdFok-hkwAAAMk"]
[Mon Apr 27 05:35:30.413302 2026] [:error] [pid 22646:tid 22689] [client 20.48.152.115:58437] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/index/function.php"] [unique_id "ae6FIok_HyZhTP6AYaeGEQAAAEY"]
[Mon Apr 27 05:35:30.926545 2026] [:error] [pid 22646:tid 22692] [client 20.48.152.115:62576] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/index/function.php"] [unique_id "ae6FIok_HyZhTP6AYaeGFAAAAEk"]
[Mon Apr 27 05:35:31.338654 2026] [:error] [pid 22751:tid 22754] [client 20.48.152.115:62515] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "ae6FIyc0tCpVyVdFok-hnQAAAME"]
[Mon Apr 27 05:35:31.752993 2026] [:error] [pid 22645:tid 22662] [client 20.48.152.115:62477] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "ae6FI3-Pq2r302zQbMaf7QAAAAc"]
[Mon Apr 27 05:35:32.178620 2026] [:error] [pid 22751:tid 22758] [client 20.48.152.115:62519] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "ae6FJCc0tCpVyVdFok-hpAAAAMQ"]
[Mon Apr 27 05:35:32.596490 2026] [:error] [pid 22647:tid 22734] [client 20.48.152.115:62466] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/uploads/autoload_classmap.php"] [unique_id "ae6FJGjfVULTjnk5SzOSIwAAAJg"]
[Mon Apr 27 05:35:33.103265 2026] [:error] [pid 22647:tid 22721] [client 20.48.152.115:62548] [client 20.48.152.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "ae6FJWjfVULTjnk5SzOSJwAAAIs"]
[Mon Apr 27 05:35:33.522095 2026] [:error] [pid 22647:tid 22731] [client 20.48.152.115:58443] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ww1.php"] [unique_id "ae6FJWjfVULTjnk5SzOSRAAAAJU"]
[Mon Apr 27 05:35:33.936759 2026] [:error] [pid 22751:tid 22765] [client 20.48.152.115:62564] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ww1.php"] [unique_id "ae6FJSc0tCpVyVdFok-hrgAAAMs"]
[Mon Apr 27 05:35:34.348885 2026] [:error] [pid 22751:tid 22763] [client 20.48.152.115:62475] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ww1.php"] [unique_id "ae6FJic0tCpVyVdFok-hswAAAMk"]
[Mon Apr 27 05:35:34.765626 2026] [:error] [pid 22646:tid 22697] [client 20.48.152.115:62558] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about/function.php"] [unique_id "ae6FJok_HyZhTP6AYaeGGAAAAE4"]
[Mon Apr 27 05:35:35.182701 2026] [:error] [pid 22751:tid 22762] [client 20.48.152.115:62589] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about/function.php"] [unique_id "ae6FJyc0tCpVyVdFok-huwAAAMg"]
[Mon Apr 27 05:35:35.621486 2026] [:error] [pid 22751:tid 22768] [client 20.48.152.115:62584] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about/function.php"] [unique_id "ae6FJyc0tCpVyVdFok-hzQAAAM4"]
[Mon Apr 27 05:35:36.031766 2026] [:error] [pid 22751:tid 22772] [client 20.48.152.115:58399] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/about/function.php"] [unique_id "ae6FKCc0tCpVyVdFok-h1wAAANI"]
[Mon Apr 27 05:35:36.445900 2026] [:error] [pid 22751:tid 22767] [client 20.48.152.115:62465] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin/function.php"] [unique_id "ae6FKCc0tCpVyVdFok-h4gAAAM0"]
[Mon Apr 27 05:35:36.869099 2026] [:error] [pid 22646:tid 22698] [client 20.48.152.115:62555] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin/function.php"] [unique_id "ae6FKIk_HyZhTP6AYaeGGgAAAE8"]
[Mon Apr 27 05:35:37.301852 2026] [:error] [pid 22751:tid 22759] [client 20.48.152.115:62501] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin/function.php"] [unique_id "ae6FKSc0tCpVyVdFok-h8AAAAMU"]
[Mon Apr 27 05:35:37.718008 2026] [:error] [pid 22751:tid 22753] [client 20.48.152.115:58381] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin/function.php"] [unique_id "ae6FKSc0tCpVyVdFok-h9AAAAMA"]
[Mon Apr 27 05:35:38.140010 2026] [:error] [pid 22751:tid 22771] [client 20.48.152.115:62494] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ae6FKic0tCpVyVdFok-iAQAAANE"]
[Mon Apr 27 05:35:38.555072 2026] [:error] [pid 22645:tid 22656] [client 20.48.152.115:58376] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ae6FKn-Pq2r302zQbMaf-wAAAAE"]
[Mon Apr 27 05:35:38.975314 2026] [:error] [pid 22645:tid 22670] [client 20.48.152.115:62492] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ae6FKn-Pq2r302zQbMaf_AAAAA8"]
[Mon Apr 27 05:35:39.397785 2026] [:error] [pid 22647:tid 22728] [client 20.48.152.115:62525] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/index.php"] [unique_id "ae6FK2jfVULTjnk5SzOSZwAAAJI"]
[Mon Apr 27 05:35:39.824600 2026] [:error] [pid 22647:tid 22731] [client 20.48.152.115:62587] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "ae6FK2jfVULTjnk5SzOSbQAAAJU"]
[Mon Apr 27 05:35:40.246088 2026] [:error] [pid 22645:tid 22672] [client 20.48.152.115:62591] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "ae6FLH-Pq2r302zQbMagBQAAABE"]
[Mon Apr 27 05:35:40.670996 2026] [:error] [pid 22645:tid 22658] [client 20.48.152.115:62577] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "ae6FLH-Pq2r302zQbMagCQAAAAM"]
[Mon Apr 27 05:35:41.096913 2026] [:error] [pid 22751:tid 22758] [client 20.48.152.115:58439] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/css/colors/blue/index.php"] [unique_id "ae6FLSc0tCpVyVdFok-iGQAAAMQ"]
[Mon Apr 27 05:35:41.509979 2026] [:error] [pid 22751:tid 22755] [client 20.48.152.115:62470] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/security.php"] [unique_id "ae6FLSc0tCpVyVdFok-iHgAAAMI"]
[Mon Apr 27 05:35:41.921021 2026] [:error] [pid 22751:tid 22762] [client 20.48.152.115:58454] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/security.php"] [unique_id "ae6FLSc0tCpVyVdFok-iJwAAAMg"]
[Mon Apr 27 05:35:42.400399 2026] [:error] [pid 22646:tid 22695] [client 20.48.152.115:58450] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/security.php"] [unique_id "ae6FLok_HyZhTP6AYaeGQQAAAEw"]
[Mon Apr 27 05:35:42.865020 2026] [:error] [pid 22646:tid 22693] [client 20.48.152.115:58419] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/security.php"] [unique_id "ae6FLok_HyZhTP6AYaeGRgAAAEo"]
[Mon Apr 27 05:35:43.281821 2026] [:error] [pid 22647:tid 22714] [client 20.48.152.115:62529] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "ae6FL2jfVULTjnk5SzOSiAAAAIQ"]
[Mon Apr 27 05:35:43.696493 2026] [:error] [pid 22645:tid 22674] [client 20.48.152.115:58414] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "ae6FL3-Pq2r302zQbMagGwAAABM"]
[Mon Apr 27 05:35:44.113499 2026] [:error] [pid 22751:tid 22765] [client 20.48.152.115:58470] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "ae6FMCc0tCpVyVdFok-iMAAAAMs"]
[Mon Apr 27 05:35:44.527654 2026] [:error] [pid 22646:tid 22693] [client 20.48.152.115:62566] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/about.php"] [unique_id "ae6FMIk_HyZhTP6AYaeGWgAAAEo"]
[Mon Apr 27 05:35:44.940528 2026] [:error] [pid 22646:tid 22688] [client 20.48.152.115:62543] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ae6FMIk_HyZhTP6AYaeGYAAAAEU"]
[Mon Apr 27 05:35:45.362741 2026] [:error] [pid 22647:tid 22734] [client 20.48.152.115:62464] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ae6FMWjfVULTjnk5SzOSlgAAAJg"]
[Mon Apr 27 05:35:45.809174 2026] [:error] [pid 22645:tid 22674] [client 20.48.152.115:62479] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ae6FMX-Pq2r302zQbMagLwAAABM"]
[Mon Apr 27 05:35:46.235554 2026] [:error] [pid 22645:tid 22664] [client 20.48.152.115:62503] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ae6FMn-Pq2r302zQbMagOAAAAAk"]
[Mon Apr 27 05:35:46.650646 2026] [:error] [pid 22751:tid 22771] [client 20.48.152.115:62472] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "ae6FMic0tCpVyVdFok-iNgAAANE"]
[Mon Apr 27 05:35:47.067847 2026] [:error] [pid 22647:tid 22731] [client 20.48.152.115:62467] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "ae6FM2jfVULTjnk5SzOSogAAAJU"]
[Mon Apr 27 05:35:47.615529 2026] [:error] [pid 22645:tid 22675] [client 20.48.152.115:58389] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "ae6FM3-Pq2r302zQbMagTAAAABQ"]
[Mon Apr 27 05:35:48.035088 2026] [:error] [pid 22645:tid 22679] [client 20.48.152.115:62583] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/upgrade/about.php"] [unique_id "ae6FNH-Pq2r302zQbMagUQAAABg"]
[Mon Apr 27 05:35:48.466788 2026] [:error] [pid 22646:tid 22707] [client 20.48.152.115:58380] [client 20.48.152.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "ae6FNIk_HyZhTP6AYaeGfQAAAFg"]
[Mon Apr 27 05:35:48.878145 2026] [:error] [pid 22751:tid 22773] [client 20.48.152.115:57936] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/radio.php"] [unique_id "ae6FNCc0tCpVyVdFok-iQQAAANM"]
[Mon Apr 27 05:35:49.331552 2026] [:error] [pid 22751:tid 22762] [client 20.48.152.115:62551] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/radio.php"] [unique_id "ae6FNSc0tCpVyVdFok-iRwAAAMg"]
[Mon Apr 27 05:35:49.755987 2026] [:error] [pid 22645:tid 22665] [client 20.48.152.115:58476] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/radio.php"] [unique_id "ae6FNX-Pq2r302zQbMagYQAAAAo"]
[Mon Apr 27 05:35:50.169537 2026] [:error] [pid 22647:tid 22723] [client 20.48.152.115:58372] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "ae6FNmjfVULTjnk5SzOSuQAAAI0"]
[Mon Apr 27 05:35:50.599572 2026] [:error] [pid 22646:tid 22694] [client 20.48.152.115:62509] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "ae6FNok_HyZhTP6AYaeGgwAAAEs"]
[Mon Apr 27 05:35:51.035851 2026] [:error] [pid 22646:tid 22693] [client 20.48.152.115:62580] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "ae6FN4k_HyZhTP6AYaeGiAAAAEo"]
[Mon Apr 27 05:35:51.454982 2026] [:error] [pid 22647:tid 22730] [client 20.48.152.115:62540] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "ae6FN2jfVULTjnk5SzOSwwAAAJQ"]
[Mon Apr 27 05:35:51.897571 2026] [:error] [pid 22645:tid 22669] [client 20.48.152.115:62575] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/admin.php"] [unique_id "ae6FN3-Pq2r302zQbMagbQAAAA4"]
[Mon Apr 27 05:35:52.318937 2026] [:error] [pid 22645:tid 22660] [client 20.48.152.115:62489] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/admin.php"] [unique_id "ae6FOH-Pq2r302zQbMagcAAAAAU"]
[Mon Apr 27 05:35:52.739996 2026] [:error] [pid 22647:tid 22725] [client 20.48.152.115:58457] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/admin.php"] [unique_id "ae6FOGjfVULTjnk5SzOSzwAAAI8"]
[Mon Apr 27 05:35:53.272875 2026] [:error] [pid 22645:tid 22672] [client 20.48.152.115:62474] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/admin.php"] [unique_id "ae6FOX-Pq2r302zQbMageQAAABE"]
[Mon Apr 27 05:35:53.714871 2026] [:error] [pid 22645:tid 22675] [client 20.48.152.115:62545] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "ae6FOX-Pq2r302zQbMagfwAAABQ"]
[Mon Apr 27 05:35:54.130058 2026] [:error] [pid 22646:tid 22691] [client 20.48.152.115:58461] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "ae6FOok_HyZhTP6AYaeGnQAAAEg"]
[Mon Apr 27 05:35:54.543139 2026] [:error] [pid 22751:tid 22764] [client 20.48.152.115:62512] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "ae6FOic0tCpVyVdFok-ieAAAAMo"]
[Mon Apr 27 05:35:54.961755 2026] [:error] [pid 22647:tid 22718] [client 20.48.152.115:58477] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "ae6FOmjfVULTjnk5SzOS2AAAAIg"]
[Mon Apr 27 05:35:55.445250 2026] [:error] [pid 22751:tid 22777] [client 20.48.152.115:58393] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "ae6FOyc0tCpVyVdFok-ifQAAANc"]
[Mon Apr 27 05:35:55.893810 2026] [:error] [pid 22647:tid 22724] [client 20.48.152.115:62497] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "ae6FO2jfVULTjnk5SzOS3gAAAI4"]
[Mon Apr 27 05:35:56.319544 2026] [:error] [pid 22645:tid 22656] [client 20.48.152.115:58488] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "ae6FPH-Pq2r302zQbMagjwAAAAE"]
[Mon Apr 27 05:35:56.789624 2026] [:error] [pid 22647:tid 22715] [client 20.48.152.115:58390] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "ae6FPGjfVULTjnk5SzOS5wAAAIU"]
[Mon Apr 27 05:35:57.207507 2026] [:error] [pid 22647:tid 22722] [client 20.48.152.115:58407] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "ae6FPWjfVULTjnk5SzOS7QAAAIw"]
[Mon Apr 27 05:35:57.636482 2026] [:error] [pid 22645:tid 22662] [client 20.48.152.115:58474] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "ae6FPX-Pq2r302zQbMagngAAAAc"]
[Mon Apr 27 05:35:58.064415 2026] [:error] [pid 22751:tid 22771] [client 20.48.152.115:62552] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "ae6FPic0tCpVyVdFok-ilAAAANE"]
[Mon Apr 27 05:35:58.539943 2026] [:error] [pid 22646:tid 22702] [client 20.48.152.115:58420] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentytwo/index.php"] [unique_id "ae6FPok_HyZhTP6AYaeGtwAAAFM"]
[Mon Apr 27 05:35:58.968982 2026] [:error] [pid 22751:tid 22775] [client 20.48.152.115:58494] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/log.php"] [unique_id "ae6FPic0tCpVyVdFok-ipwAAANU"]
[Mon Apr 27 05:35:59.399242 2026] [:error] [pid 22751:tid 22757] [client 20.48.152.115:58458] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/log.php"] [unique_id "ae6FPyc0tCpVyVdFok-irQAAAMM"]
[Mon Apr 27 05:35:59.879529 2026] [:error] [pid 22751:tid 22769] [client 20.48.152.115:58396] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/log.php"] [unique_id "ae6FPyc0tCpVyVdFok-itQAAAM8"]
[Mon Apr 27 05:36:00.323834 2026] [:error] [pid 22751:tid 22762] [client 20.48.152.115:58393] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/log.php"] [unique_id "ae6FQCc0tCpVyVdFok-iugAAAMg"]
[Mon Apr 27 05:36:00.745261 2026] [:error] [pid 22751:tid 22761] [client 20.48.152.115:58471] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class.php"] [unique_id "ae6FQCc0tCpVyVdFok-iwgAAAMc"]
[Mon Apr 27 05:36:01.175948 2026] [:error] [pid 22645:tid 22673] [client 20.48.152.115:58456] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class.php"] [unique_id "ae6FQX-Pq2r302zQbMagpQAAABI"]
[Mon Apr 27 05:36:01.587732 2026] [:error] [pid 22751:tid 22761] [client 20.48.152.115:57966] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class.php"] [unique_id "ae6FQSc0tCpVyVdFok-i0QAAAMc"]
[Mon Apr 27 05:36:02.016360 2026] [:error] [pid 22647:tid 22717] [client 20.48.152.115:58469] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class.php"] [unique_id "ae6FQmjfVULTjnk5SzOTDQAAAIc"]
[Mon Apr 27 05:36:02.432366 2026] [:error] [pid 22646:tid 22692] [client 20.48.152.115:62504] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless5.php"] [unique_id "ae6FQok_HyZhTP6AYaeGxwAAAEk"]
[Mon Apr 27 05:36:02.857311 2026] [:error] [pid 22647:tid 22734] [client 20.48.152.115:58463] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless5.php"] [unique_id "ae6FQmjfVULTjnk5SzOTEgAAAJg"]
[Mon Apr 27 05:36:03.349124 2026] [:error] [pid 22645:tid 22669] [client 20.48.152.115:57948] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless5.php"] [unique_id "ae6FQ3-Pq2r302zQbMagtQAAAA4"]
[Mon Apr 27 05:36:03.762797 2026] [:error] [pid 22646:tid 22705] [client 20.48.152.115:62483] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/bless5.php"] [unique_id "ae6FQ4k_HyZhTP6AYaeGzwAAAFY"]
[Mon Apr 27 05:36:04.200709 2026] [:error] [pid 22646:tid 22702] [client 20.48.152.115:57950] [client 20.48.152.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "ae6FRIk_HyZhTP6AYaeG1AAAAFM"]
[Mon Apr 27 05:36:04.618270 2026] [:error] [pid 22645:tid 22679] [client 20.48.152.115:57937] [client 20.48.152.115] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "ae6FRH-Pq2r302zQbMagvwAAABg"]
[Mon Apr 27 05:36:05.035713 2026] [:error] [pid 22645:tid 22661] [client 20.48.152.115:62518] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock360.php"] [unique_id "ae6FRX-Pq2r302zQbMagwwAAAAY"]
[Mon Apr 27 05:36:05.456313 2026] [:error] [pid 22645:tid 22668] [client 20.48.152.115:58385] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock360.php"] [unique_id "ae6FRX-Pq2r302zQbMagxwAAAA0"]
[Mon Apr 27 05:36:05.872363 2026] [:error] [pid 22646:tid 22684] [client 20.48.152.115:57941] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock360.php"] [unique_id "ae6FRYk_HyZhTP6AYaeG3gAAAEE"]
[Mon Apr 27 05:36:06.301533 2026] [:error] [pid 22647:tid 22726] [client 20.48.152.115:62493] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/lock360.php"] [unique_id "ae6FRmjfVULTjnk5SzOTMAAAAJA"]
[Mon Apr 27 05:36:06.729759 2026] [:error] [pid 22645:tid 22660] [client 20.48.152.115:58475] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "ae6FRn-Pq2r302zQbMag0wAAAAU"]
[Mon Apr 27 05:36:07.368881 2026] [:error] [pid 22646:tid 22684] [client 20.48.152.115:62500] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "ae6FR4k_HyZhTP6AYaeG7QAAAEE"]
[Mon Apr 27 05:36:07.808595 2026] [:error] [pid 22751:tid 22753] [client 20.48.152.115:62507] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "ae6FRyc0tCpVyVdFok-i8wAAAMA"]
[Mon Apr 27 05:36:08.282013 2026] [:error] [pid 22646:tid 22698] [client 20.48.152.115:58473] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "ae6FSIk_HyZhTP6AYaeG-QAAAE8"]
[Mon Apr 27 05:36:08.748373 2026] [:error] [pid 22647:tid 22725] [client 20.48.152.115:58462] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o1.php"] [unique_id "ae6FSGjfVULTjnk5SzOTPQAAAI8"]
[Mon Apr 27 05:36:09.215913 2026] [:error] [pid 22647:tid 22724] [client 20.48.152.115:58495] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o1.php"] [unique_id "ae6FSWjfVULTjnk5SzOTQQAAAI4"]
[Mon Apr 27 05:36:09.631131 2026] [:error] [pid 22645:tid 22672] [client 20.48.152.115:62571] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o1.php"] [unique_id "ae6FSX-Pq2r302zQbMag2QAAABE"]
[Mon Apr 27 05:36:10.109807 2026] [:error] [pid 22751:tid 22777] [client 20.48.152.115:62538] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ioxi-o1.php"] [unique_id "ae6FSic0tCpVyVdFok-jBwAAANc"]
[Mon Apr 27 05:36:10.543481 2026] [:error] [pid 22645:tid 22655] [client 20.48.152.115:58479] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/juuuu.php"] [unique_id "ae6FSn-Pq2r302zQbMag4gAAAAA"]
[Mon Apr 27 05:36:10.998265 2026] [:error] [pid 22646:tid 22688] [client 20.48.152.115:58481] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/juuuu.php"] [unique_id "ae6FSok_HyZhTP6AYaeHCAAAAEU"]
[Mon Apr 27 05:36:11.417455 2026] [:error] [pid 22646:tid 22702] [client 20.48.152.115:62516] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/juuuu.php"] [unique_id "ae6FS4k_HyZhTP6AYaeHDgAAAFM"]
[Mon Apr 27 05:36:11.884530 2026] [:error] [pid 22646:tid 22699] [client 20.48.152.115:62473] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/juuuu.php"] [unique_id "ae6FS4k_HyZhTP6AYaeHGAAAAFA"]
[Mon Apr 27 05:36:12.314907 2026] [:error] [pid 22645:tid 22667] [client 20.48.152.115:62573] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ha.php"] [unique_id "ae6FTH-Pq2r302zQbMag5AAAAAw"]
[Mon Apr 27 05:36:12.729865 2026] [:error] [pid 22647:tid 22734] [client 20.48.152.115:62523] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ha.php"] [unique_id "ae6FTGjfVULTjnk5SzOTVgAAAJg"]
[Mon Apr 27 05:36:13.150195 2026] [:error] [pid 22645:tid 22674] [client 20.48.152.115:62511] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ha.php"] [unique_id "ae6FTX-Pq2r302zQbMag6gAAABM"]
[Mon Apr 27 05:36:13.583579 2026] [:error] [pid 22647:tid 22733] [client 20.48.152.115:58485] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ha.php"] [unique_id "ae6FTWjfVULTjnk5SzOTXQAAAJc"]
[Mon Apr 27 05:36:14.034317 2026] [:error] [pid 22751:tid 22769] [client 20.48.152.115:62536] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gg.php"] [unique_id "ae6FTic0tCpVyVdFok-jLgAAAM8"]
[Mon Apr 27 05:36:14.454114 2026] [:error] [pid 22646:tid 22688] [client 20.48.152.115:58403] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gg.php"] [unique_id "ae6FTok_HyZhTP6AYaeHKgAAAEU"]
[Mon Apr 27 05:36:14.930001 2026] [:error] [pid 22646:tid 22704] [client 20.48.152.115:62476] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/gg.php"] [unique_id "ae6FTok_HyZhTP6AYaeHLAAAAFU"]
[Mon Apr 27 05:36:32.581133 2026] [:error] [pid 22645:tid 22673] [client 20.48.152.115:62586] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xaz.php"] [unique_id "ae6FYH-Pq2r302zQbMahcAAAABI"]
[Mon Apr 27 05:36:33.012289 2026] [:error] [pid 22751:tid 22772] [client 20.48.152.115:62569] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xaz.php"] [unique_id "ae6FYSc0tCpVyVdFok-j6wAAANI"]
[Mon Apr 27 05:36:33.426774 2026] [:error] [pid 22751:tid 22769] [client 20.48.152.115:57929] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xaz.php"] [unique_id "ae6FYSc0tCpVyVdFok-j7AAAAM8"]
[Mon Apr 27 05:36:33.859124 2026] [:error] [pid 22751:tid 22753] [client 20.48.152.115:58412] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xaz.php"] [unique_id "ae6FYSc0tCpVyVdFok-j7gAAAMA"]
[Mon Apr 27 05:36:34.281282 2026] [:error] [pid 22751:tid 22755] [client 20.48.152.115:62581] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/up4.php"] [unique_id "ae6FYic0tCpVyVdFok-j7wAAAMI"]
[Mon Apr 27 05:36:34.697316 2026] [:error] [pid 22646:tid 22697] [client 20.48.152.115:62482] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/up4.php"] [unique_id "ae6FYok_HyZhTP6AYaeHnAAAAE4"]
[Mon Apr 27 05:36:35.192863 2026] [:error] [pid 22646:tid 22704] [client 20.48.152.115:57973] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/up4.php"] [unique_id "ae6FY4k_HyZhTP6AYaeHngAAAFU"]
[Mon Apr 27 05:36:35.614739 2026] [:error] [pid 22646:tid 22691] [client 20.48.152.115:57921] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/up4.php"] [unique_id "ae6FY4k_HyZhTP6AYaeHoQAAAEg"]
[Mon Apr 27 05:36:36.031119 2026] [:error] [pid 22647:tid 22712] [client 20.48.152.115:62528] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1aa.php"] [unique_id "ae6FZGjfVULTjnk5SzOT1AAAAII"]
[Mon Apr 27 05:36:36.445493 2026] [:error] [pid 22751:tid 22770] [client 20.48.152.115:57933] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1aa.php"] [unique_id "ae6FZCc0tCpVyVdFok-j8QAAANA"]
[Mon Apr 27 05:36:36.869331 2026] [:error] [pid 22647:tid 22720] [client 20.48.152.115:58409] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1aa.php"] [unique_id "ae6FZGjfVULTjnk5SzOT1QAAAIo"]
[Mon Apr 27 05:36:37.286282 2026] [:error] [pid 22647:tid 22727] [client 20.48.152.115:58400] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/1aa.php"] [unique_id "ae6FZWjfVULTjnk5SzOT2QAAAJE"]
[Mon Apr 27 05:36:37.708889 2026] [:error] [pid 22647:tid 22710] [client 20.48.152.115:58387] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/elp.php"] [unique_id "ae6FZWjfVULTjnk5SzOT2wAAAIA"]
[Mon Apr 27 05:36:38.371967 2026] [:error] [pid 22751:tid 22777] [client 20.48.152.115:57953] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/elp.php"] [unique_id "ae6FZic0tCpVyVdFok-kAQAAANc"]
[Mon Apr 27 05:36:38.787907 2026] [:error] [pid 22647:tid 22731] [client 20.48.152.115:62590] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/elp.php"] [unique_id "ae6FZmjfVULTjnk5SzOT4gAAAJU"]
[Mon Apr 27 05:36:39.211520 2026] [:error] [pid 22645:tid 22675] [client 20.48.152.115:62541] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/elp.php"] [unique_id "ae6FZ3-Pq2r302zQbMahgAAAABQ"]
[Mon Apr 27 05:36:39.662828 2026] [:error] [pid 22646:tid 22701] [client 20.48.152.115:58397] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtz.php"] [unique_id "ae6FZ4k_HyZhTP6AYaeHswAAAFI"]
[Mon Apr 27 05:36:40.092175 2026] [:error] [pid 22646:tid 22685] [client 20.48.152.115:57932] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtz.php"] [unique_id "ae6FaIk_HyZhTP6AYaeHtAAAAEI"]
[Mon Apr 27 05:36:40.510630 2026] [:error] [pid 22645:tid 22673] [client 20.48.152.115:62517] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtz.php"] [unique_id "ae6FaH-Pq2r302zQbMahjQAAABI"]
[Mon Apr 27 05:36:40.924718 2026] [:error] [pid 22647:tid 22725] [client 20.48.152.115:57920] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wtz.php"] [unique_id "ae6FaGjfVULTjnk5SzOT7wAAAI8"]
[Mon Apr 27 05:36:41.354823 2026] [:error] [pid 22646:tid 22707] [client 20.48.152.115:58493] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/galex.php"] [unique_id "ae6FaYk_HyZhTP6AYaeHvAAAAFg"]
[Mon Apr 27 05:36:41.846204 2026] [:error] [pid 22646:tid 22684] [client 20.48.152.115:58421] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/galex.php"] [unique_id "ae6FaYk_HyZhTP6AYaeHvwAAAEE"]
[Mon Apr 27 05:36:42.269277 2026] [:error] [pid 22645:tid 22661] [client 20.48.152.115:62588] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/galex.php"] [unique_id "ae6Fan-Pq2r302zQbMahogAAAAY"]
[Mon Apr 27 05:36:42.715520 2026] [:error] [pid 22647:tid 22729] [client 20.48.152.115:58374] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/galex.php"] [unique_id "ae6FamjfVULTjnk5SzOT-wAAAJM"]
[Mon Apr 27 05:36:43.146217 2026] [:error] [pid 22647:tid 22716] [client 20.48.152.115:52944] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xb.php"] [unique_id "ae6Fa2jfVULTjnk5SzOUAAAAAIY"]
[Mon Apr 27 05:36:43.562627 2026] [:error] [pid 22751:tid 22771] [client 20.48.152.115:62486] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xb.php"] [unique_id "ae6Fayc0tCpVyVdFok-kIwAAANE"]
[Mon Apr 27 05:36:43.988418 2026] [:error] [pid 22647:tid 22720] [client 20.48.152.115:58417] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xb.php"] [unique_id "ae6Fa2jfVULTjnk5SzOUCAAAAIo"]
[Mon Apr 27 05:36:44.410651 2026] [:error] [pid 22646:tid 22686] [client 20.48.152.115:58490] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xb.php"] [unique_id "ae6FbIk_HyZhTP6AYaeHzAAAAEM"]
[Mon Apr 27 05:36:44.832999 2026] [:error] [pid 22647:tid 22733] [client 20.48.152.115:62563] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ova.php"] [unique_id "ae6FbGjfVULTjnk5SzOUDwAAAJc"]
[Mon Apr 27 05:36:45.250023 2026] [:error] [pid 22647:tid 22731] [client 20.48.152.115:58386] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ova.php"] [unique_id "ae6FbWjfVULTjnk5SzOUGQAAAJU"]
[Mon Apr 27 05:36:45.683371 2026] [:error] [pid 22751:tid 22770] [client 20.48.152.115:57925] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ova.php"] [unique_id "ae6FbSc0tCpVyVdFok-kMAAAANA"]
[Mon Apr 27 05:36:46.121039 2026] [:error] [pid 22751:tid 22754] [client 20.48.152.115:57896] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ova.php"] [unique_id "ae6Fbic0tCpVyVdFok-kNQAAAME"]
[Mon Apr 27 05:36:46.655128 2026] [:error] [pid 22751:tid 22759] [client 20.48.152.115:58466] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vx.php"] [unique_id "ae6Fbic0tCpVyVdFok-kPgAAAMU"]
[Mon Apr 27 05:36:47.079827 2026] [:error] [pid 22645:tid 22660] [client 20.48.152.115:58480] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vx.php"] [unique_id "ae6Fb3-Pq2r302zQbMahvQAAAAU"]
[Mon Apr 27 05:36:47.508652 2026] [:error] [pid 22645:tid 22658] [client 20.48.152.115:58441] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vx.php"] [unique_id "ae6Fb3-Pq2r302zQbMahxQAAAAM"]
[Mon Apr 27 05:36:47.942847 2026] [:error] [pid 22646:tid 22694] [client 20.48.152.115:57976] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/vx.php"] [unique_id "ae6Fb4k_HyZhTP6AYaeH0gAAAEs"]
[Mon Apr 27 05:36:48.565635 2026] [:error] [pid 22647:tid 22711] [client 20.48.152.115:62508] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rh.php"] [unique_id "ae6FcGjfVULTjnk5SzOUNAAAAIE"]
[Mon Apr 27 05:36:48.988143 2026] [:error] [pid 22751:tid 22757] [client 20.48.152.115:62567] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rh.php"] [unique_id "ae6FcCc0tCpVyVdFok-kUgAAAMM"]
[Mon Apr 27 05:36:49.413036 2026] [:error] [pid 22751:tid 22758] [client 20.48.152.115:58452] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rh.php"] [unique_id "ae6FcSc0tCpVyVdFok-kVgAAAMQ"]
[Mon Apr 27 05:36:49.830556 2026] [:error] [pid 22751:tid 22768] [client 20.48.152.115:62524] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/rh.php"] [unique_id "ae6FcSc0tCpVyVdFok-kXwAAAM4"]
[Mon Apr 27 05:36:52.039580 2026] [:error] [pid 22751:tid 22761] [client 20.48.152.115:58429] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plugins.php"] [unique_id "ae6FdCc0tCpVyVdFok-keAAAAMc"]
[Mon Apr 27 05:36:52.463005 2026] [:error] [pid 22751:tid 22777] [client 20.48.152.115:57957] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plugins.php"] [unique_id "ae6FdCc0tCpVyVdFok-khQAAANc"]
[Mon Apr 27 05:36:52.888061 2026] [:error] [pid 22647:tid 22717] [client 20.48.152.115:58369] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plugins.php"] [unique_id "ae6FdGjfVULTjnk5SzOURwAAAIc"]
[Mon Apr 27 05:36:53.406796 2026] [:error] [pid 22647:tid 22732] [client 20.48.152.115:52871] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/plugins.php"] [unique_id "ae6FdWjfVULTjnk5SzOUUQAAAJY"]
[Mon Apr 27 05:36:53.867510 2026] [:error] [pid 22751:tid 22774] [client 20.48.152.115:62471] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/users.php"] [unique_id "ae6FdSc0tCpVyVdFok-kiwAAANQ"]
[Mon Apr 27 05:36:54.329994 2026] [:error] [pid 22646:tid 22684] [client 20.48.152.115:58371] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/users.php"] [unique_id "ae6Fdok_HyZhTP6AYaeIDwAAAEE"]
[Mon Apr 27 05:36:54.757138 2026] [:error] [pid 22645:tid 22661] [client 20.48.152.115:58408] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/users.php"] [unique_id "ae6Fdn-Pq2r302zQbMah2wAAAAY"]
[Mon Apr 27 05:36:55.191010 2026] [:error] [pid 22647:tid 22711] [client 20.48.152.115:57935] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/users.php"] [unique_id "ae6Fd2jfVULTjnk5SzOUZAAAAIE"]
[Mon Apr 27 05:36:55.614594 2026] [:error] [pid 22647:tid 22723] [client 20.48.152.115:52952] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "ae6Fd2jfVULTjnk5SzOUZwAAAI0"]
[Mon Apr 27 05:36:56.032655 2026] [:error] [pid 22645:tid 22656] [client 20.48.152.115:57967] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "ae6FeH-Pq2r302zQbMah5wAAAAE"]
[Mon Apr 27 05:36:56.539457 2026] [:error] [pid 22647:tid 22719] [client 20.48.152.115:62513] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "ae6FeGjfVULTjnk5SzOUbwAAAIk"]
[Mon Apr 27 05:36:56.972957 2026] [:error] [pid 22647:tid 22720] [client 20.48.152.115:62490] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "ae6FeGjfVULTjnk5SzOUdgAAAIo"]
[Mon Apr 27 05:36:57.392022 2026] [:error] [pid 22646:tid 22690] [client 20.48.152.115:58449] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/profile.php"] [unique_id "ae6FeYk_HyZhTP6AYaeIKAAAAEc"]
[Mon Apr 27 05:36:57.873711 2026] [:error] [pid 22646:tid 22696] [client 20.48.152.115:62526] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/profile.php"] [unique_id "ae6FeYk_HyZhTP6AYaeIMQAAAE0"]
[Mon Apr 27 05:36:58.300919 2026] [:error] [pid 22646:tid 22706] [client 20.48.152.115:62521] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/profile.php"] [unique_id "ae6Feok_HyZhTP6AYaeIOAAAAFc"]
[Mon Apr 27 05:36:58.748486 2026] [:error] [pid 22751:tid 22753] [client 20.48.152.115:58460] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/profile.php"] [unique_id "ae6Feic0tCpVyVdFok-krwAAAMA"]
[Mon Apr 27 05:36:59.190649 2026] [:error] [pid 22751:tid 22770] [client 20.48.152.115:57961] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/menu.php"] [unique_id "ae6Feyc0tCpVyVdFok-ksQAAANA"]
[Mon Apr 27 05:36:59.604591 2026] [:error] [pid 22647:tid 22711] [client 20.48.152.115:58432] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/menu.php"] [unique_id "ae6Fe2jfVULTjnk5SzOUgwAAAIE"]
[Mon Apr 27 05:37:00.023698 2026] [:error] [pid 22646:tid 22685] [client 20.48.152.115:62554] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/menu.php"] [unique_id "ae6FfIk_HyZhTP6AYaeISgAAAEI"]
[Mon Apr 27 05:37:00.454594 2026] [:error] [pid 22646:tid 22688] [client 20.48.152.115:58468] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/menu.php"] [unique_id "ae6FfIk_HyZhTP6AYaeIUwAAAEU"]
[Mon Apr 27 05:37:00.874020 2026] [:error] [pid 22751:tid 22770] [client 20.48.152.115:58431] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sites.php"] [unique_id "ae6FfCc0tCpVyVdFok-kwAAAANA"]
[Mon Apr 27 05:37:01.299349 2026] [:error] [pid 22645:tid 22676] [client 20.48.152.115:57932] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sites.php"] [unique_id "ae6FfX-Pq2r302zQbMah_AAAABU"]
[Mon Apr 27 05:37:01.753759 2026] [:error] [pid 22645:tid 22662] [client 20.48.152.115:62574] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sites.php"] [unique_id "ae6FfX-Pq2r302zQbMah_wAAAAc"]
[Mon Apr 27 05:37:02.196878 2026] [:error] [pid 22751:tid 22778] [client 20.48.152.115:58459] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/sites.php"] [unique_id "ae6Ffic0tCpVyVdFok-kzgAAANg"]
[Mon Apr 27 05:37:02.624778 2026] [:error] [pid 22645:tid 22678] [client 20.48.152.115:58373] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/byp.php"] [unique_id "ae6Ffn-Pq2r302zQbMaiBAAAABc"]
[Mon Apr 27 05:37:03.192631 2026] [:error] [pid 22645:tid 22672] [client 20.48.152.115:62496] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/byp.php"] [unique_id "ae6Ff3-Pq2r302zQbMaiCQAAABE"]
[Mon Apr 27 05:37:03.612837 2026] [:error] [pid 22645:tid 22673] [client 20.48.152.115:62522] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/byp.php"] [unique_id "ae6Ff3-Pq2r302zQbMaiDAAAABI"]
[Mon Apr 27 05:37:04.040970 2026] [:error] [pid 22751:tid 22762] [client 20.48.152.115:62547] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/byp.php"] [unique_id "ae6FgCc0tCpVyVdFok-k4QAAAMg"]
[Mon Apr 27 05:37:04.460302 2026] [:error] [pid 22647:tid 22724] [client 20.48.152.115:58410] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/100.php"] [unique_id "ae6FgGjfVULTjnk5SzOUpQAAAI4"]
[Mon Apr 27 05:37:04.886366 2026] [:error] [pid 22646:tid 22704] [client 20.48.152.115:58416] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/100.php"] [unique_id "ae6FgIk_HyZhTP6AYaeIbQAAAFU"]
[Mon Apr 27 05:37:05.361379 2026] [:error] [pid 22751:tid 22753] [client 20.48.152.115:58398] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/100.php"] [unique_id "ae6FgSc0tCpVyVdFok-k6gAAAMA"]
[Mon Apr 27 05:37:05.790122 2026] [:error] [pid 22751:tid 22766] [client 20.48.152.115:52934] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/100.php"] [unique_id "ae6FgSc0tCpVyVdFok-k7gAAAMw"]
[Mon Apr 27 05:37:06.247178 2026] [:error] [pid 22751:tid 22777] [client 20.48.152.115:58425] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mini.php"] [unique_id "ae6Fgic0tCpVyVdFok-k-gAAANc"]
[Mon Apr 27 05:37:06.663114 2026] [:error] [pid 22751:tid 22768] [client 20.48.152.115:62469] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mini.php"] [unique_id "ae6Fgic0tCpVyVdFok-lCAAAAM4"]
[Mon Apr 27 05:37:07.248041 2026] [:error] [pid 22751:tid 22755] [client 20.48.152.115:58450] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mini.php"] [unique_id "ae6Fgyc0tCpVyVdFok-lFwAAAMI"]
[Mon Apr 27 05:37:07.671326 2026] [:error] [pid 22645:tid 22672] [client 20.48.152.115:62544] [client 20.48.152.115] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/mini.php"] [unique_id "ae6Fg3-Pq2r302zQbMaiHwAAABE"]
[Mon Apr 27 08:00:55.449787 2026] [proxy_fcgi:error] [pid 50862:tid 50904] [client 20.219.12.30:2777] AH01071: Got error 'Primary script unknown'
[Mon Apr 27 08:01:06.304025 2026] [:error] [pid 50862:tid 50909] [client 20.219.12.30:2777] [client 20.219.12.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.12.30, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/images/wp-login.php"] [unique_id "ae6nQktKr9IOeW7InlXC6wAAAJE"]
[Mon Apr 27 13:51:52.015727 2026] [:error] [pid 62511:tid 62585] [client 34.55.86.97:57675] [client 34.55.86.97] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/media/system/js/core.js"] [unique_id "ae75eLBjE-jhU4FY4HhzZAAAAUs"]
[Mon Apr 27 14:59:32.948700 2026] [:error] [pid 41011:tid 41078] [client 146.70.240.214:44690] [client 146.70.240.214] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 5 at IP:ddos. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "10"] [id "400002"] [msg "DDoS threshold exceeded for 146.70.240.214, counter = 14"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ae8JVAsl5QfsSXIdF6EDDwAAAgk"]
[Tue Apr 28 03:08:00.527154 2026] [:error] [pid 36747:tid 36765] [client 185.194.178.198:45971] [client 185.194.178.198] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.194.178.198, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ae-0EM9QpT00aPhkIcd0FgAAAZA"]
[Tue Apr 28 04:21:04.039141 2026] [:error] [pid 14578:tid 14630] [client 4.193.121.6:9985] [client 4.193.121.6] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 4.193.121.6, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ae_FMOngo3AwIJgfSHHaHwAAAFE"]
[Tue Apr 28 04:21:05.608742 2026] [:error] [pid 14578:tid 14630] [client 4.193.121.6:9985] [client 4.193.121.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ae_FMengo3AwIJgfSHHaNAAAAFE"]
[Tue Apr 28 04:21:06.744788 2026] [:error] [pid 14578:tid 14633] [client 4.193.121.6:10012] [client 4.193.121.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "ae_FMungo3AwIJgfSHHaPwAAAFQ"]
[Tue Apr 28 04:21:07.522697 2026] [:error] [pid 14686:tid 14700] [client 4.193.121.6:10170] [client 4.193.121.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ae_FM--YPF1Xm7uiWQ7zBAAAAMs"]
[Tue Apr 28 04:21:08.612750 2026] [:error] [pid 14577:tid 14594] [client 4.193.121.6:10032] [client 4.193.121.6] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "ae_FNCzBH-jwzlgiBdGScwAAAAg"]
[Tue Apr 28 17:53:18.853575 2026] [:error] [pid 33777:tid 33837] [client 45.215.251.199:10249] [client 45.215.251.199] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.215.251.199, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afCDjrXUCFWqmordGGKmsgAAAQI"]
[Tue Apr 28 19:49:54.695111 2026] [:error] [pid 50889:tid 50904] [client 51.13.187.146:60229] [client 51.13.187.146] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afCe4ozszBr00txEzGg_jwAAAAw"]
[Tue Apr 28 22:16:26.106294 2026] [:error] [pid 2741:tid 2753] [client 4.225.204.143:14053] [client 4.225.204.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afDBOvp92FeOz1h6ILwUEwAAAUc"]
[Wed Apr 29 15:35:11.132044 2026] [:error] [pid 61540:tid 61588] [client 45.119.85.39:62554] [client 45.119.85.39] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.119.85.39, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wordpress/wp-login.php"] [unique_id "afG0r-Q8cJB7pQslzIfVmQAAAI8"], referer: https://www.google.com
[Wed Apr 29 15:35:11.132113 2026] [:error] [pid 61540:tid 61588] [client 45.119.85.39:62554] [client 45.119.85.39] ModSecurity: Access denied with code 403 (phase 1). Operator GT matched 10 at IP:wpbrute. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "18"] [id "400004"] [msg "Brute force protection triggered for 45.119.85.39 on wp-login.php, counter = 121"] [hostname "paramountestate.com.au"] [uri "/wordpress/wp-login.php"] [unique_id "afG0r-Q8cJB7pQslzIfVmQAAAI8"], referer: https://www.google.com
[Thu Apr 30 04:28:35.987819 2026] [:error] [pid 52436:tid 52453] [client 150.242.87.50:1041] [client 150.242.87.50] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 150.242.87.50, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afJp8wLFWPk_P7AfE8fPXwAAAU4"]
[Thu Apr 30 12:40:54.808035 2026] [:error] [pid 18111:tid 18144] [client 20.215.248.255:38889] [client 20.215.248.255] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.215.248.255, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afLdVmctLbxB7Q1_oK3w-AAAABY"]
[Fri May 01 03:22:16.020558 2026] [:error] [pid 21839:tid 21861] [client 104.28.214.115:18433] [client 104.28.214.115] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/style.php"] [unique_id "afOr6J_Sh66m95WwxJ4kggAAAVM"]
[Fri May 01 04:56:40.691098 2026] [:error] [pid 5976:tid 5984] [client 92.53.64.155:58675] [client 92.53.64.155] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "afPCCLbCb0ye2WjKlddy3gAAAQQ"]
[Fri May 01 05:59:49.329986 2026] [:error] [pid 6046:tid 6106] [client 34.47.43.122:57332] [client 34.47.43.122] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "afPQ1YyBrpmb1HMIbiTUIwAAAZY"]
[Fri May 01 21:22:35.145810 2026] [:error] [pid 24995:tid 25013] [client 187.101.62.172:52861] [client 187.101.62.172] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 187.101.62.172, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afSpG-dJG9WB_Q_ne0u5UQAAAE4"]
[Sat May 02 04:50:04.355619 2026] [:error] [pid 22846:tid 22851] [client 136.111.253.56:34672] [client 136.111.253.56] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "afUR_Im1Ms03Mfhp3aaRmQAAAQM"]
[Sat May 02 12:35:12.752820 2026] [:error] [pid 51917:tid 51943] [client 192.96.159.129:59831] [client 192.96.159.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "afV_AK7wZviJ7BgcCi8NzAAAAdg"]
[Sat May 02 18:42:36.324353 2026] [:error] [pid 51950:tid 52000] [client 45.24.22.8:62434] [client 45.24.22.8] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.24.22.8, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afXVHIoBJzYZ3RKUhdhDswAAAlQ"]
[Sun May 03 09:42:10.799507 2026] [:error] [pid 40422:tid 40437] [client 172.173.121.85:61890] [client 172.173.121.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afan8kHBbBLrXh6PBuuoyQAAAUs"]
[Sun May 03 12:16:36.279687 2026] [:error] [pid 37126:tid 37176] [client 172.173.121.85:64518] [client 172.173.121.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afbMJPR_A42N-LtDyrv5QwAAABc"]
[Sun May 03 16:23:41.004560 2026] [:error] [pid 37126:tid 37153] [client 34.139.48.68:47126] [client 34.139.48.68] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "afcGDfR_A42N-LtDyrsizQAAAAI"]
[Sun May 03 17:18:13.334633 2026] [:error] [pid 34432:tid 34441] [client 213.246.11.140:55899] [client 213.246.11.140] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 213.246.11.140, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afcS1Z73JKVQ0wlof4I9fwAAAcc"]
[Mon May 04 09:54:40.178080 2026] [:error] [pid 12022:tid 12037] [client 20.9.90.138:16972] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class-t.api.php"] [unique_id "aff8YEVhgvCNKBWnaTJGdQAAAI0"]
[Mon May 04 09:54:40.939496 2026] [:error] [pid 33186:tid 33192] [client 20.9.90.138:18558] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class-t.api.php"] [unique_id "aff8YLqlqe0DcmBS9VzuZQAAAAM"]
[Mon May 04 09:54:41.726042 2026] [:error] [pid 11959:tid 12004] [client 20.9.90.138:16998] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class-t.api.php"] [unique_id "aff8YQojk2nvxs7h5KvgYAAAANA"]
[Mon May 04 09:54:42.484685 2026] [:error] [pid 33186:tid 33208] [client 20.9.90.138:19731] [client 20.9.90.138] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/class-t.api.php"] [unique_id "aff8Yrqlqe0DcmBS9VzuogAAABM"]
[Mon May 04 17:12:09.106002 2026] [:error] [pid 61043:tid 61081] [client 182.181.235.215:59881] [client 182.181.235.215] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 182.181.235.215, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afhi6Z8-LwtfURjiAbCRNwAAAEY"]
[Mon May 04 17:13:00.859280 2026] [:error] [pid 61044:tid 61125] [client 20.207.192.179:2894] [client 20.207.192.179] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.207.192.179, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "afhjHEw8w2zZZXI6H1t7HAAAABc"]
[Mon May 04 17:13:02.119521 2026] [:error] [pid 61044:tid 61112] [client 20.207.192.179:2894] [client 20.207.192.179] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.207.192.179, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afhjHkw8w2zZZXI6H1t7KAAAAAo"]
[Mon May 04 17:13:03.845986 2026] [:error] [pid 61044:tid 61126] [client 20.207.192.179:2894] [client 20.207.192.179] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "afhjH0w8w2zZZXI6H1t7NgAAABg"]
[Tue May 05 03:40:20.217940 2026] [:error] [pid 32471:tid 32483] [client 209.87.169.230:36923] [client 209.87.169.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "www.paramountestate.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "afj2JHmjpb9EYq6AqhLYkQAAAQk"]
[Tue May 05 07:46:12.416570 2026] [:error] [pid 41055:tid 41060] [client 45.86.200.59:20387] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "afkvxCepFwKgA_SKOHgTagAAAQI"]
[Tue May 05 07:46:13.907659 2026] [:error] [pid 53856:tid 53873] [client 45.86.200.55:24037] [client 45.86.200.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/worksec.php"] [unique_id "afkvxXG_NPOxSH0O9aQVFgAAAUg"]
[Tue May 05 07:46:16.213148 2026] [:error] [pid 53856:tid 53877] [client 45.86.200.85:42427] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tinyfilemanager.php"] [unique_id "afkvyHG_NPOxSH0O9aQVsAAAAUw"]
[Tue May 05 07:46:17.585005 2026] [:error] [pid 41055:tid 41068] [client 45.86.200.83:37207] [client 45.86.200.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "afkvySepFwKgA_SKOHgUAAAAAQo"]
[Tue May 05 07:46:18.762244 2026] [:error] [pid 41055:tid 41079] [client 45.86.200.52:53147] [client 45.86.200.52] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/wp-conflg.php"] [unique_id "afkvyiepFwKgA_SKOHgUJgAAARU"]
[Tue May 05 07:46:20.466435 2026] [:error] [pid 53856:tid 53865] [client 45.86.200.100:29319] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/dyqvcfqv.php"] [unique_id "afkvzHG_NPOxSH0O9aQWuAAAAUA"]
[Tue May 05 07:46:21.294446 2026] [:error] [pid 41055:tid 41066] [client 45.86.200.53:58463] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "afkvzSepFwKgA_SKOHgUaQAAAQg"]
[Tue May 05 07:46:21.851364 2026] [:error] [pid 39073:tid 39136] [client 185.82.72.4:61907] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/admin.php"] [unique_id "afkvzf0kT1BNjk46Bkds2gAAAII"]
[Tue May 05 07:46:22.398334 2026] [:error] [pid 39071:tid 39082] [client 45.86.200.108:49947] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/wp-conflg.php"] [unique_id "afkvzovmnRMz9gRzix2iGgAAAAI"]
[Tue May 05 07:46:22.934116 2026] [:error] [pid 39178:tid 39183] [client 45.86.200.99:25451] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/admin.php"] [unique_id "afkvzjaPrgTaiOD_15uypgAAAMM"]
[Tue May 05 07:46:23.490581 2026] [:error] [pid 53856:tid 53880] [client 45.86.200.87:61661] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-login.php"] [unique_id "afkvz3G_NPOxSH0O9aQXYQAAAU8"]
[Tue May 05 07:46:24.311013 2026] [:error] [pid 39072:tid 39118] [client 45.86.200.102:48607] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/options.php"] [unique_id "afkv0PolSHl4aAnrIossBgAAAEs"]
[Tue May 05 07:46:25.444428 2026] [:error] [pid 53856:tid 53872] [client 45.86.200.74:60723] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "afkv0XG_NPOxSH0O9aQX4QAAAUc"]
[Tue May 05 07:46:26.556323 2026] [:error] [pid 41055:tid 41063] [client 45.86.200.59:41261] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/admin.php"] [unique_id "afkv0iepFwKgA_SKOHgVBAAAAQU"]
[Tue May 05 07:46:27.377566 2026] [:error] [pid 41055:tid 41066] [client 45.86.200.84:61129] [client 45.86.200.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/jquery.php"] [unique_id "afkv0yepFwKgA_SKOHgVIAAAAQg"]
[Tue May 05 07:46:28.214725 2026] [:error] [pid 41055:tid 41077] [client 45.86.200.60:62579] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/autoload_classmap.php"] [unique_id "afkv1CepFwKgA_SKOHgVPAAAARM"]
[Tue May 05 07:46:31.444209 2026] [:error] [pid 41055:tid 41073] [client 45.86.200.90:43731] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/table/int/tmpl/index.php"] [unique_id "afkv1yepFwKgA_SKOHgVjQAAAQ8"]
[Tue May 05 07:46:32.276315 2026] [:error] [pid 39072:tid 39110] [client 45.86.200.106:41073] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/suggest.php"] [unique_id "afkv2PolSHl4aAnrIostCgAAAEM"]
[Tue May 05 07:46:33.358017 2026] [:error] [pid 39071:tid 39096] [client 45.86.200.53:59009] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/defaults.php"] [unique_id "afkv2YvmnRMz9gRzix2jNgAAABA"]
[Tue May 05 07:46:34.174978 2026] [:error] [pid 53856:tid 53878] [client 45.86.200.111:48661] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "afkv2nG_NPOxSH0O9aQZyAAAAU0"]
[Tue May 05 07:46:35.959103 2026] [:error] [pid 39071:tid 39093] [client 45.86.200.105:49393] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "afkv24vmnRMz9gRzix2jigAAAA0"]
[Tue May 05 07:46:36.790352 2026] [:error] [pid 53856:tid 53887] [client 45.86.200.60:61231] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/about.php"] [unique_id "afkv3HG_NPOxSH0O9aQaPwAAAVY"]
[Tue May 05 07:46:37.621092 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.100:64847] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/index.php"] [unique_id "afkv3XG_NPOxSH0O9aQabAAAAVE"]
[Tue May 05 07:46:38.240265 2026] [:error] [pid 41055:tid 41070] [client 45.86.200.99:54247] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php/wp-content/x/index.php"] [unique_id "afkv3iepFwKgA_SKOHgWPAAAAQw"]
[Tue May 05 07:46:39.856101 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.58:42439] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "afkv33G_NPOxSH0O9aQa0AAAAVA"]
[Tue May 05 07:46:41.289603 2026] [:error] [pid 53856:tid 53879] [client 45.86.200.95:51753] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/info.php"] [unique_id "afkv4XG_NPOxSH0O9aQbHwAAAU4"]
[Tue May 05 07:46:41.836210 2026] [:error] [pid 41055:tid 41071] [client 45.86.200.75:53595] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class.api.php"] [unique_id "afkv4SepFwKgA_SKOHgWlgAAAQ0"]
[Tue May 05 07:46:42.401173 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.91:62513] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "afkv4nG_NPOxSH0O9aQbVgAAAVE"]
[Tue May 05 07:46:45.237610 2026] [:error] [pid 39072:tid 39122] [client 45.86.200.106:47879] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/admin.php"] [unique_id "afkv5folSHl4aAnrIosuyQAAAE8"]
[Tue May 05 07:46:53.303106 2026] [:error] [pid 39073:tid 39157] [client 45.86.200.52:22673] [client 45.86.200.52] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.52, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/wp-login.php"] [unique_id "afkv7f0kT1BNjk46BkdwfAAAAJc"]
[Tue May 05 07:46:56.728432 2026] [:error] [pid 39073:tid 39150] [client 45.86.200.52:22673] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/about.php"] [unique_id "afkv8P0kT1BNjk46Bkdw6wAAAJA"]
[Tue May 05 07:46:57.832349 2026] [:error] [pid 53856:tid 53889] [client 45.86.200.112:43635] [client 45.86.200.112] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.112, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/wp-login.php"] [unique_id "afkv8XG_NPOxSH0O9aQewAAAAVg"]
[Tue May 05 07:46:58.424440 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.112:43635] [client 45.86.200.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/item.php"] [unique_id "afkv8nG_NPOxSH0O9aQe4gAAAVM"]
[Tue May 05 07:47:01.575104 2026] [:error] [pid 53856:tid 53867] [client 45.86.200.91:49035] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/husky301.php"] [unique_id "afkv9XG_NPOxSH0O9aQfgQAAAUI"]
[Tue May 05 07:47:04.403640 2026] [:error] [pid 39072:tid 39130] [client 45.86.200.58:40195] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/index.php"] [unique_id "afkv-PolSHl4aAnrIosxIgAAAFc"]
[Tue May 05 07:47:05.563545 2026] [:error] [pid 39178:tid 39189] [client 185.82.72.4:41523] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/classwithtostring.php"] [unique_id "afkv-TaPrgTaiOD_15u4EAAAAMk"]
[Tue May 05 07:47:06.951115 2026] [:error] [pid 41055:tid 41065] [client 45.86.200.108:35165] [client 45.86.200.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.108, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/wp-login.php"] [unique_id "afkv-iepFwKgA_SKOHgZzQAAAQc"]
[Tue May 05 07:47:07.225929 2026] [:error] [pid 41055:tid 41075] [client 45.86.200.108:35165] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/endpoints/index.php"] [unique_id "afkv-yepFwKgA_SKOHgZ1wAAARE"]
[Tue May 05 07:47:13.739736 2026] [:error] [pid 41055:tid 41080] [client 45.86.200.73:48911] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/bypass.php"] [unique_id "afkwASepFwKgA_SKOHganQAAARY"]
[Tue May 05 07:47:15.209251 2026] [:error] [pid 53856:tid 53887] [client 45.86.200.59:23159] [client 45.86.200.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.59, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/midnight/wp-login.php"] [unique_id "afkwA3G_NPOxSH0O9aQhegAAAVY"]
[Tue May 05 07:47:16.400630 2026] [:error] [pid 53856:tid 53887] [client 45.86.200.59:23159] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/about.php"] [unique_id "afkwBHG_NPOxSH0O9aQhnAAAAVY"]
[Tue May 05 07:47:17.257663 2026] [:error] [pid 53856:tid 53865] [client 45.86.200.105:30699] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/infi.php"] [unique_id "afkwBXG_NPOxSH0O9aQhuQAAAUA"]
[Tue May 05 07:47:18.363621 2026] [:error] [pid 53856:tid 53887] [client 45.86.200.53:43335] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "afkwBnG_NPOxSH0O9aQh4AAAAVY"]
[Tue May 05 07:47:20.617277 2026] [:error] [pid 39178:tid 39193] [client 45.86.200.112:44787] [client 45.86.200.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-user.php"] [unique_id "afkwCDaPrgTaiOD_15u6tAAAAM0"]
[Tue May 05 07:47:21.522737 2026] [:error] [pid 39178:tid 39203] [client 45.86.200.87:31711] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "afkwCTaPrgTaiOD_15u61AAAANc"]
[Tue May 05 07:47:22.060585 2026] [:error] [pid 39178:tid 39203] [client 45.86.200.52:49757] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/index.php"] [unique_id "afkwCjaPrgTaiOD_15u66wAAANc"]
[Tue May 05 07:47:24.128719 2026] [:error] [pid 39071:tid 39091] [client 185.82.72.4:41055] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/autoload_classmap.php"] [unique_id "afkwDIvmnRMz9gRzix2naQAAAAs"]
[Tue May 05 07:47:26.159608 2026] [:error] [pid 53856:tid 53873] [client 45.86.200.100:51277] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "afkwDnG_NPOxSH0O9aQjAwAAAUg"]
[Tue May 05 07:47:27.554360 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.75:37311] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/edit.php"] [unique_id "afkwD3G_NPOxSH0O9aQjNQAAAVc"]
[Tue May 05 07:47:29.003530 2026] [:error] [pid 41055:tid 41069] [client 45.86.200.103:43465] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-work.php"] [unique_id "afkwECepFwKgA_SKOHgcKwAAAQs"]
[Tue May 05 07:47:30.194438 2026] [:error] [pid 39073:tid 39144] [client 45.86.200.54:31919] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/click.php"] [unique_id "afkwEv0kT1BNjk46Bkd0fgAAAIo"]
[Tue May 05 07:47:31.580050 2026] [:error] [pid 39073:tid 39156] [client 45.86.200.98:58625] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/random_compat/chosen.php"] [unique_id "afkwE_0kT1BNjk46Bkd0ogAAAJY"]
[Tue May 05 07:47:34.094063 2026] [:error] [pid 39073:tid 39152] [client 45.86.200.97:57233] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jquery/bypass.php"] [unique_id "afkwFv0kT1BNjk46Bkd02gAAAJI"]
[Tue May 05 07:47:34.625310 2026] [:error] [pid 39178:tid 39190] [client 45.86.200.52:64647] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/xl2023.php"] [unique_id "afkwFjaPrgTaiOD_15u87QAAAMo"]
[Tue May 05 07:47:35.169544 2026] [:error] [pid 39072:tid 39108] [client 45.86.200.74:61833] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/admin.php"] [unique_id "afkwF_olSHl4aAnrIos2eAAAAEE"]
[Tue May 05 07:47:35.708049 2026] [:error] [pid 39072:tid 39126] [client 45.86.200.102:48597] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/dog.php"] [unique_id "afkwF_olSHl4aAnrIos2igAAAFM"]
[Tue May 05 07:47:36.529182 2026] [:error] [pid 39072:tid 39107] [client 45.86.200.101:30491] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/applicationd.php"] [unique_id "afkwGPolSHl4aAnrIos2pQAAAEA"]
[Tue May 05 07:47:37.097991 2026] [:error] [pid 39073:tid 39137] [client 45.86.200.105:48587] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "afkwGf0kT1BNjk46Bkd1LwAAAIM"]
[Tue May 05 07:47:38.195955 2026] [:error] [pid 39072:tid 39108] [client 45.86.200.83:50439] [client 45.86.200.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "afkwGvolSHl4aAnrIos23gAAAEE"]
[Tue May 05 07:47:38.772681 2026] [:error] [pid 39073:tid 39141] [client 45.86.200.59:57729] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "afkwGv0kT1BNjk46Bkd1WQAAAIc"]
[Tue May 05 07:47:39.317023 2026] [:error] [pid 39071:tid 39085] [client 45.86.200.51:30331] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/admin.php"] [unique_id "afkwG4vmnRMz9gRzix2o9AAAAAU"]
[Tue May 05 07:47:39.868344 2026] [:error] [pid 53856:tid 53880] [client 45.86.200.78:44219] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/security.php"] [unique_id "afkwG3G_NPOxSH0O9aQlLAAAAU8"]
[Tue May 05 07:47:40.724260 2026] [:error] [pid 53856:tid 53885] [client 185.82.72.4:22805] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/autoload_classmap.php"] [unique_id "afkwHHG_NPOxSH0O9aQlaAAAAVQ"]
[Tue May 05 07:47:41.803333 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.76:65083] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/about.php"] [unique_id "afkwHfolSHl4aAnrIos3QQAAAEQ"]
[Tue May 05 07:47:43.437120 2026] [:error] [pid 39073:tid 39154] [client 45.86.200.57:21537] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/about.php"] [unique_id "afkwH_0kT1BNjk46Bkd11AAAAJQ"]
[Tue May 05 07:47:45.983790 2026] [:error] [pid 41055:tid 41081] [client 45.86.200.107:25287] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/file.php"] [unique_id "afkwISepFwKgA_SKOHgeeQAAARc"]
[Tue May 05 07:47:47.405405 2026] [:error] [pid 39072:tid 39124] [client 45.86.200.94:61753] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/dedi1.php"] [unique_id "afkwI_olSHl4aAnrIos38QAAAFE"]
[Tue May 05 07:47:47.960785 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.90:49165] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/autoload_classmap.php"] [unique_id "afkwI3G_NPOxSH0O9aQnDwAAAVE"]
[Tue May 05 07:47:49.650924 2026] [:error] [pid 39072:tid 39129] [client 45.86.200.73:28209] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "afkwJfolSHl4aAnrIos4QgAAAFY"]
[Tue May 05 07:47:51.045322 2026] [proxy_fcgi:error] [pid 39072:tid 39125] [client 45.86.200.78:35283] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:47:51.320575 2026] [proxy_fcgi:error] [pid 39072:tid 39109] [client 45.86.200.78:35283] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:47:51.590264 2026] [proxy_fcgi:error] [pid 39072:tid 39122] [client 45.86.200.78:35283] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:47:52.984663 2026] [:error] [pid 39072:tid 39127] [client 45.86.200.78:35283] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "afkwKPolSHl4aAnrIos4ugAAAFQ"]
[Tue May 05 07:47:54.615782 2026] [:error] [pid 53856:tid 53872] [client 185.82.72.4:28233] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/index.php"] [unique_id "afkwKnG_NPOxSH0O9aQoYAAAAUc"]
[Tue May 05 07:47:55.222012 2026] [:error] [pid 53856:tid 53872] [client 45.86.200.86:37363] [client 45.86.200.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/about.php"] [unique_id "afkwK3G_NPOxSH0O9aQojgAAAUc"]
[Tue May 05 07:47:55.761248 2026] [:error] [pid 41055:tid 41063] [client 45.86.200.55:28147] [client 45.86.200.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Exception/Http/about.php"] [unique_id "afkwKyepFwKgA_SKOHgfowAAAQU"]
[Tue May 05 07:47:56.300440 2026] [:error] [pid 39178:tid 39188] [client 45.86.200.60:56061] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/index.php"] [unique_id "afkwLDaPrgTaiOD_15u_fwAAAMg"]
[Tue May 05 07:47:56.896585 2026] [:error] [pid 39178:tid 39186] [client 45.86.200.54:26569] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "afkwLDaPrgTaiOD_15u_lwAAAMY"]
[Tue May 05 07:47:57.780590 2026] [:error] [pid 39178:tid 39198] [client 45.86.200.76:27079] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/index.php"] [unique_id "afkwLTaPrgTaiOD_15u_uAAAANI"]
[Tue May 05 07:47:58.318268 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.83:30251] [client 45.86.200.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "afkwLjaPrgTaiOD_15u_yAAAANE"]
[Tue May 05 07:47:58.854406 2026] [:error] [pid 39073:tid 39147] [client 45.86.200.56:64199] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "afkwLv0kT1BNjk46Bkd3OQAAAI0"]
[Tue May 05 07:47:59.392943 2026] [:error] [pid 39073:tid 39157] [client 45.86.200.58:56843] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/wp-login.php"] [unique_id "afkwL_0kT1BNjk46Bkd3TgAAAJc"]
[Tue May 05 07:48:00.547051 2026] [:error] [pid 39072:tid 39117] [client 45.86.200.75:57121] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/themes.php"] [unique_id "afkwMPolSHl4aAnrIos5lgAAAEo"]
[Tue May 05 07:48:01.376384 2026] [:error] [pid 39178:tid 39191] [client 45.86.200.75:32167] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/index.php"] [unique_id "afkwMTaPrgTaiOD_15vAGQAAAMs"]
[Tue May 05 07:48:02.534850 2026] [:error] [pid 39071:tid 39100] [client 45.86.200.110:54143] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/wp-login.php"] [unique_id "afkwMovmnRMz9gRzix2rzAAAABQ"]
[Tue May 05 07:48:03.656179 2026] [:error] [pid 39072:tid 39110] [client 45.86.200.75:28275] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/about.php"] [unique_id "afkwM_olSHl4aAnrIos51gAAAEM"]
[Tue May 05 07:48:05.142254 2026] [:error] [pid 41055:tid 41077] [client 45.86.200.80:50153] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/wp-login.php"] [unique_id "afkwNSepFwKgA_SKOHgg7gAAARM"]
[Tue May 05 07:48:06.979201 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.54:32889] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/about.php"] [unique_id "afkwNnG_NPOxSH0O9aQrQAAAAVM"]
[Tue May 05 07:48:07.804747 2026] [:error] [pid 39073:tid 39135] [client 45.86.200.104:57075] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-class.php"] [unique_id "afkwN_0kT1BNjk46Bkd4aQAAAIE"]
[Tue May 05 07:48:12.908866 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.51:31591] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/chosen.php"] [unique_id "afkwPHG_NPOxSH0O9aQsEAAAAVI"]
[Tue May 05 07:48:13.449881 2026] [:error] [pid 41055:tid 41069] [client 45.86.200.81:36421] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "afkwPSepFwKgA_SKOHgh9AAAAQs"]
[Tue May 05 07:48:14.290096 2026] [:error] [pid 39072:tid 39114] [client 45.86.200.57:48219] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/index.php"] [unique_id "afkwPvolSHl4aAnrIos69wAAAEc"]
[Tue May 05 07:48:15.437411 2026] [:error] [pid 53856:tid 53878] [client 45.86.200.92:31757] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "afkwP3G_NPOxSH0O9aQsaAAAAU0"]
[Tue May 05 07:48:16.091427 2026] [:error] [pid 53856:tid 53887] [client 45.86.200.97:44941] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "afkwQHG_NPOxSH0O9aQsfgAAAVY"]
[Tue May 05 07:48:18.960281 2026] [:error] [pid 39178:tid 39183] [client 45.86.200.102:55099] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afkwQjaPrgTaiOD_15vB-gAAAMM"]
[Tue May 05 07:48:19.513419 2026] [:error] [pid 39072:tid 39112] [client 185.82.72.4:42683] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "afkwQ_olSHl4aAnrIos73wAAAEU"]
[Tue May 05 07:48:21.470149 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.75:52665] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/calendar/index.php"] [unique_id "afkwRXG_NPOxSH0O9aQtcAAAAVM"]
[Tue May 05 07:48:22.315317 2026] [proxy_fcgi:error] [pid 39073:tid 39153] [client 45.86.200.87:30977] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:48:22.875302 2026] [:error] [pid 39073:tid 39134] [client 45.86.200.87:30977] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/function.php"] [unique_id "afkwRv0kT1BNjk46Bkd6YwAAAIA"]
[Tue May 05 07:48:23.411347 2026] [:error] [pid 41055:tid 41082] [client 45.86.200.103:28169] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/plugins.php"] [unique_id "afkwRyepFwKgA_SKOHgjXAAAARg"]
[Tue May 05 07:48:24.585355 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.98:48161] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/chosen.php"] [unique_id "afkwSDaPrgTaiOD_15vCbQAAANE"]
[Tue May 05 07:48:25.142094 2026] [:error] [pid 53856:tid 53867] [client 45.86.200.54:23543] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/about.php"] [unique_id "afkwSXG_NPOxSH0O9aQt9AAAAUI"]
[Tue May 05 07:48:27.655379 2026] [:error] [pid 39071:tid 39099] [client 45.86.200.87:27575] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/atomlib.php"] [unique_id "afkwS4vmnRMz9gRzix2uQgAAABM"]
[Tue May 05 07:48:28.197553 2026] [:error] [pid 41055:tid 41066] [client 45.86.200.78:28411] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/index.php"] [unique_id "afkwTCepFwKgA_SKOHgkKAAAAQg"]
[Tue May 05 07:48:29.949477 2026] [:error] [pid 53856:tid 53867] [client 45.86.200.110:28941] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "afkwTXG_NPOxSH0O9aQu5gAAAUI"]
[Tue May 05 07:48:30.536694 2026] [:error] [pid 39072:tid 39124] [client 45.86.200.99:32375] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "afkwTvolSHl4aAnrIos9fQAAAFE"]
[Tue May 05 07:48:31.075444 2026] [:error] [pid 39178:tid 39194] [client 45.86.200.51:30223] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "afkwTzaPrgTaiOD_15vDGAAAAM4"]
[Tue May 05 07:48:33.170673 2026] [:error] [pid 53856:tid 53877] [client 45.86.200.56:61941] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Exception-wp.php"] [unique_id "afkwUXG_NPOxSH0O9aQveQAAAUw"]
[Tue May 05 07:48:34.036425 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.85:52769] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/autoload_classmap.php"] [unique_id "afkwUnG_NPOxSH0O9aQvrAAAAVA"]
[Tue May 05 07:48:36.565590 2026] [:error] [pid 39072:tid 39123] [client 45.86.200.57:59237] [client 45.86.200.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.57, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/js/wp-login.php"] [unique_id "afkwVPolSHl4aAnrIos-YgAAAFA"]
[Tue May 05 07:48:42.554510 2026] [:error] [pid 39072:tid 39107] [client 45.86.200.57:59237] [client 45.86.200.57] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.57, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-login.php"] [unique_id "afkwWvolSHl4aAnrIos_CQAAAEA"]
[Tue May 05 07:48:45.654346 2026] [proxy_fcgi:error] [pid 39072:tid 39108] [client 45.86.200.57:59237] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:48:49.854413 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.57:59237] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "afkwYfolSHl4aAnrIos_8gAAAEQ"]
[Tue May 05 07:48:51.222972 2026] [:error] [pid 41055:tid 41078] [client 45.86.200.53:34775] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/autoload_classmap.php"] [unique_id "afkwYyepFwKgA_SKOHgneAAAARQ"]
[Tue May 05 07:48:52.335072 2026] [:error] [pid 39071:tid 39085] [client 45.86.200.106:62653] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/atomlib.php"] [unique_id "afkwZIvmnRMz9gRzix2xTgAAAAU"]
[Tue May 05 07:48:55.450695 2026] [:error] [pid 39071:tid 39097] [client 45.86.200.106:22185] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/autoload_classmap.php"] [unique_id "afkwZ4vmnRMz9gRzix2xuQAAABE"]
[Tue May 05 07:48:56.602553 2026] [:error] [pid 39072:tid 39129] [client 45.86.200.88:46195] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "afkwaPolSHl4aAnrIotAngAAAFY"]
[Tue May 05 07:48:57.481456 2026] [:error] [pid 39073:tid 39146] [client 45.86.200.107:26383] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/index.php"] [unique_id "afkwaf0kT1BNjk46Bkd-MAAAAIw"]
[Tue May 05 07:48:59.133316 2026] [proxy_fcgi:error] [pid 39072:tid 39131] [client 45.86.200.51:46565] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:48:59.435587 2026] [proxy_fcgi:error] [pid 39072:tid 39107] [client 45.86.200.51:46565] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:48:59.859496 2026] [:error] [pid 39072:tid 39115] [client 45.86.200.51:46565] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/autoload_classmap.php"] [unique_id "afkwa_olSHl4aAnrIotA6AAAAEg"]
[Tue May 05 07:49:01.290609 2026] [:error] [pid 53856:tid 53886] [client 45.86.200.91:30045] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-conflg.php"] [unique_id "afkwbXG_NPOxSH0O9aQzYwAAAVU"]
[Tue May 05 07:49:07.143073 2026] [:error] [pid 41055:tid 41075] [client 45.86.200.85:25773] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/default.php"] [unique_id "afkwcyepFwKgA_SKOHgo6AAAARE"]
[Tue May 05 07:49:09.240114 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.108:23643] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "afkwdfolSHl4aAnrIotBdAAAAEQ"]
[Tue May 05 07:49:11.992124 2026] [:error] [pid 39178:tid 39183] [client 45.86.200.79:54269] [client 45.86.200.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/src/index.php"] [unique_id "afkwdzaPrgTaiOD_15vHGQAAAMM"]
[Tue May 05 07:49:15.618989 2026] [:error] [pid 41055:tid 41067] [client 185.82.72.3:20325] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Parse/about.php"] [unique_id "afkweyepFwKgA_SKOHgpugAAAQk"]
[Tue May 05 07:49:16.167299 2026] [proxy_fcgi:error] [pid 39072:tid 39115] [client 45.86.200.60:20895] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:49:17.007689 2026] [:error] [pid 39072:tid 39108] [client 45.86.200.60:20895] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/wp-conflg.php"] [unique_id "afkwffolSHl4aAnrIotCaQAAAEE"]
[Tue May 05 07:49:18.959343 2026] [proxy_fcgi:error] [pid 39073:tid 39148] [client 45.86.200.80:27133] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:49:19.510676 2026] [:error] [pid 39073:tid 39148] [client 45.86.200.80:27133] [client 45.86.200.80] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.80, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/ocean/wp-login.php"] [unique_id "afkwf_0kT1BNjk46BkeANAAAAI4"]
[Tue May 05 07:49:20.893370 2026] [:error] [pid 39073:tid 39142] [client 45.86.200.80:27133] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Cache/upfile.php"] [unique_id "afkwgP0kT1BNjk46BkeAawAAAIg"]
[Tue May 05 07:49:21.748515 2026] [:error] [pid 41055:tid 41081] [client 45.86.200.73:64943] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/plugins/fullscreen/about.php"] [unique_id "afkwgSepFwKgA_SKOHgqhQAAARc"]
[Tue May 05 07:49:23.488268 2026] [:error] [pid 39071:tid 39084] [client 45.86.200.89:51165] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-function.php"] [unique_id "afkwg4vmnRMz9gRzix20XQAAAAQ"]
[Tue May 05 07:49:25.926856 2026] [:error] [pid 41055:tid 41071] [client 45.86.200.85:63191] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Canonical.php"] [unique_id "afkwhSepFwKgA_SKOHgrKAAAAQ0"]
[Tue May 05 07:49:26.495806 2026] [:error] [pid 39073:tid 39153] [client 45.86.200.98:43331] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "afkwhv0kT1BNjk46BkeA9wAAAJM"]
[Tue May 05 07:49:27.939351 2026] [:error] [pid 41055:tid 41077] [client 45.86.200.73:34253] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-feed-index.php"] [unique_id "afkwhyepFwKgA_SKOHgragAAARM"]
[Tue May 05 07:49:29.044291 2026] [proxy_fcgi:error] [pid 41055:tid 41077] [client 45.86.200.112:48741] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:49:29.310653 2026] [:error] [pid 41055:tid 41076] [client 45.86.200.112:48741] [client 45.86.200.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-section-boolean.php"] [unique_id "afkwiSepFwKgA_SKOHgrmgAAARI"]
[Tue May 05 07:49:30.154484 2026] [:error] [pid 39071:tid 39087] [client 45.86.200.108:40047] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/db.php"] [unique_id "afkwiovmnRMz9gRzix21DQAAAAc"]
[Tue May 05 07:49:30.693193 2026] [:error] [pid 39071:tid 39094] [client 45.86.200.84:47017] [client 45.86.200.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-dependency-float.php"] [unique_id "afkwiovmnRMz9gRzix21HwAAAA4"]
[Tue May 05 07:49:31.246158 2026] [:error] [pid 39178:tid 39183] [client 45.86.200.56:26963] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "afkwizaPrgTaiOD_15vJRAAAAMM"]
[Tue May 05 07:49:31.845212 2026] [:error] [pid 39073:tid 39153] [client 45.86.200.85:26911] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/purna.php"] [unique_id "afkwi_0kT1BNjk46BkeBbgAAAJM"]
[Tue May 05 07:49:32.381499 2026] [:error] [pid 39178:tid 39185] [client 45.86.200.73:20179] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-class.php"] [unique_id "afkwjDaPrgTaiOD_15vJZQAAAMU"]
[Tue May 05 07:49:32.916806 2026] [:error] [pid 39073:tid 39142] [client 185.82.72.3:41715] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-widddget-pages.php"] [unique_id "afkwjP0kT1BNjk46BkeBiwAAAIg"]
[Tue May 05 07:49:34.040516 2026] [:error] [pid 53856:tid 53875] [client 45.86.200.95:23407] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-nav-menu-auto-add-control-repository.php"] [unique_id "afkwjnG_NPOxSH0O9aQ3ngAAAUo"]
[Tue May 05 07:49:34.580536 2026] [:error] [pid 39072:tid 39109] [client 45.86.200.100:51711] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime.min-soap.php"] [unique_id "afkwjvolSHl4aAnrIotE8gAAAEI"]
[Tue May 05 07:49:35.161738 2026] [:error] [pid 39071:tid 39097] [client 45.86.200.93:49721] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-set.php"] [unique_id "afkwj4vmnRMz9gRzix21lQAAABE"]
[Tue May 05 07:49:35.713690 2026] [:error] [pid 39071:tid 39097] [client 45.86.200.59:57627] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/utils/license.php"] [unique_id "afkwj4vmnRMz9gRzix21pQAAABE"]
[Tue May 05 07:49:36.265873 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.108:27687] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/options.php"] [unique_id "afkwkHG_NPOxSH0O9aQ39wAAAVM"]
[Tue May 05 07:49:36.833683 2026] [proxy_fcgi:error] [pid 41055:tid 41069] [client 45.86.200.94:65161] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:49:37.681633 2026] [:error] [pid 41055:tid 41078] [client 45.86.200.94:65161] [client 45.86.200.94] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.94, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "afkwkSepFwKgA_SKOHgscAAAARQ"]
[Tue May 05 07:49:39.075646 2026] [:error] [pid 41055:tid 41073] [client 45.86.200.94:65161] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/goto.php"] [unique_id "afkwkyepFwKgA_SKOHgskAAAAQ8"]
[Tue May 05 07:49:44.209189 2026] [:error] [pid 39073:tid 39134] [client 45.86.200.100:49697] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "afkwmP0kT1BNjk46BkeCxwAAAIA"]
[Tue May 05 07:49:44.749338 2026] [:error] [pid 53856:tid 53868] [client 45.86.200.52:39687] [client 45.86.200.52] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp_class_datlib.php"] [unique_id "afkwmHG_NPOxSH0O9aQ5gQAAAUM"]
[Tue May 05 07:49:45.296200 2026] [:error] [pid 41055:tid 41070] [client 45.86.200.77:53717] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/langs/about.php"] [unique_id "afkwmSepFwKgA_SKOHgtPwAAAQw"]
[Tue May 05 07:49:47.669166 2026] [:error] [pid 39072:tid 39130] [client 45.86.200.94:55033] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Registry-private.php"] [unique_id "afkwm_olSHl4aAnrIotG4AAAAFc"]
[Tue May 05 07:49:48.206474 2026] [:error] [pid 41055:tid 41063] [client 45.86.200.60:40697] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-meta.php"] [unique_id "afkwnCepFwKgA_SKOHgtlwAAAQU"]
[Tue May 05 07:49:48.786479 2026] [:error] [pid 39073:tid 39146] [client 45.86.200.73:47265] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/bypass.php"] [unique_id "afkwnP0kT1BNjk46BkeDSwAAAIw"]
[Tue May 05 07:49:49.890393 2026] [:error] [pid 53856:tid 53873] [client 45.86.200.111:61835] [client 45.86.200.111] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfour/system_cache.php%20"] [unique_id "afkwnXG_NPOxSH0O9aQ6hAAAAUg"]
[Tue May 05 07:49:50.995687 2026] [:error] [pid 53856:tid 53880] [client 45.86.200.104:43345] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/adminfus.php"] [unique_id "afkwnnG_NPOxSH0O9aQ6wQAAAU8"]
[Tue May 05 07:49:51.820858 2026] [:error] [pid 39071:tid 39082] [client 45.86.200.58:50243] [client 45.86.200.58] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/group/wp-style.php"] [unique_id "afkwn4vmnRMz9gRzix23LwAAAAI"]
[Tue May 05 07:49:52.944228 2026] [:error] [pid 39073:tid 39143] [client 45.86.200.88:48957] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "afkwoP0kT1BNjk46BkeDtwAAAIk"]
[Tue May 05 07:49:56.535285 2026] [:error] [pid 39072:tid 39119] [client 185.82.72.4:53269] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "afkwpPolSHl4aAnrIotH-AAAAEw"]
[Tue May 05 07:49:57.399379 2026] [:error] [pid 39072:tid 39112] [client 45.86.200.102:44913] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/about.php"] [unique_id "afkwpfolSHl4aAnrIotICgAAAEU"]
[Tue May 05 07:49:59.644250 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.92:62955] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-sup.php"] [unique_id "afkwp3G_NPOxSH0O9aQ8ogAAAVI"]
[Tue May 05 07:50:00.937204 2026] [:error] [pid 53856:tid 53874] [client 45.86.200.99:34875] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-t.api.php"] [unique_id "afkwqHG_NPOxSH0O9aQ86gAAAUk"]
[Tue May 05 07:50:02.893568 2026] [:error] [pid 39073:tid 39156] [client 45.86.200.60:24913] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/require-dynamic-blocks.php"] [unique_id "afkwqv0kT1BNjk46BkeE2wAAAJY"]
[Tue May 05 07:50:04.695102 2026] [:error] [pid 53856:tid 53866] [client 45.86.200.103:29775] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-rss-database.php"] [unique_id "afkwrHG_NPOxSH0O9aQ9vQAAAUE"]
[Tue May 05 07:50:05.829187 2026] [:error] [pid 39178:tid 39192] [client 45.86.200.87:64791] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-customize-manager-client.php"] [unique_id "afkwrTaPrgTaiOD_15vM6AAAAMw"]
[Tue May 05 07:50:06.373678 2026] [:error] [pid 39073:tid 39137] [client 45.86.200.73:21501] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-modules-packages.min-boolean.php"] [unique_id "afkwrv0kT1BNjk46BkeFPQAAAIM"]
[Tue May 05 07:50:08.385286 2026] [:error] [pid 39071:tid 39104] [client 45.86.200.82:33727] [client 45.86.200.82] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/simi.php"] [unique_id "afkwsIvmnRMz9gRzix247QAAABg"]
[Tue May 05 07:50:10.320016 2026] [:error] [pid 39071:tid 39092] [client 45.86.200.108:30867] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine-session.php"] [unique_id "afkwsovmnRMz9gRzix25GQAAAAw"]
[Tue May 05 07:50:11.996436 2026] [:error] [pid 39178:tid 39191] [client 185.82.72.3:29211] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.min.php"] [unique_id "afkwszaPrgTaiOD_15vNpgAAAMs"]
[Tue May 05 07:50:13.614603 2026] [:error] [pid 39073:tid 39147] [client 45.86.200.83:63403] [client 45.86.200.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/file/wp-style.php"] [unique_id "afkwtf0kT1BNjk46BkeGKQAAAI0"]
[Tue May 05 07:50:15.565729 2026] [:error] [pid 53856:tid 53866] [client 45.86.200.84:20109] [client 45.86.200.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/class-IXR-cilent.php"] [unique_id "afkwt3G_NPOxSH0O9aQ_wgAAAUE"]
[Tue May 05 07:50:16.650487 2026] [:error] [pid 39071:tid 39095] [client 45.86.200.85:22561] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/install.php"] [unique_id "afkwuIvmnRMz9gRzix255AAAAA8"]
[Tue May 05 07:50:17.202640 2026] [:error] [pid 39072:tid 39107] [client 45.86.200.88:45961] [client 45.86.200.88] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/xleet.php"] [unique_id "afkwufolSHl4aAnrIotKRAAAAEA"]
[Tue May 05 07:50:19.454708 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.90:22055] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/category-double.php"] [unique_id "afkwu3G_NPOxSH0O9aRAegAAAVQ"]
[Tue May 05 07:50:20.690545 2026] [:error] [pid 39178:tid 39181] [client 45.86.200.56:49469] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/db.php"] [unique_id "afkwvDaPrgTaiOD_15vOhAAAAME"]
[Tue May 05 07:50:21.261146 2026] [:error] [pid 39071:tid 39101] [client 45.86.200.75:58133] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/security.php"] [unique_id "afkwvYvmnRMz9gRzix26VwAAABU"]
[Tue May 05 07:50:22.352349 2026] [:error] [pid 39178:tid 39181] [client 45.86.200.109:49631] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-language-pack.php"] [unique_id "afkwvjaPrgTaiOD_15vOoAAAAME"]
[Tue May 05 07:50:23.170218 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.86:28475] [client 45.86.200.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-walker-comment-client.php"] [unique_id "afkwv3G_NPOxSH0O9aRBMwAAAVc"]
[Tue May 05 07:50:25.116751 2026] [:error] [pid 39073:tid 39150] [client 45.86.200.102:24359] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-network-query-stat.php"] [unique_id "afkwwf0kT1BNjk46BkeHfAAAAJA"]
[Tue May 05 07:50:26.251597 2026] [:error] [pid 41055:tid 41066] [client 45.86.200.85:37891] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-session-tokens-https.php"] [unique_id "afkwwiepFwKgA_SKOHgxyAAAAQg"]
[Tue May 05 07:50:27.335151 2026] [:error] [pid 39178:tid 39186] [client 45.86.200.95:53393] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/crystal/lrs_dage.php"] [unique_id "afkwwzaPrgTaiOD_15vPDAAAAMY"]
[Tue May 05 07:50:28.168350 2026] [:error] [pid 41055:tid 41079] [client 45.86.200.54:49291] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/as.php"] [unique_id "afkwxCepFwKgA_SKOHgx9wAAARU"]
[Tue May 05 07:50:30.100853 2026] [:error] [pid 39178:tid 39202] [client 45.86.200.106:34747] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/wp-conflg.php"] [unique_id "afkwxjaPrgTaiOD_15vPQwAAANY"]
[Tue May 05 07:50:31.687901 2026] [:error] [pid 39072:tid 39111] [client 45.86.200.92:56507] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/install.php"] [unique_id "afkwx_olSHl4aAnrIotMvwAAAEQ"]
[Tue May 05 07:50:32.246361 2026] [:error] [pid 41055:tid 41071] [client 45.86.200.54:38809] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/db.php"] [unique_id "afkwyCepFwKgA_SKOHgyTAAAAQ0"]
[Tue May 05 07:50:34.475822 2026] [:error] [pid 39071:tid 39093] [client 45.86.200.103:58053] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/thickbox/about.php"] [unique_id "afkwyovmnRMz9gRzix27qQAAAA0"]
[Tue May 05 07:50:35.850567 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.90:23817] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rk2.php"] [unique_id "afkwyzaPrgTaiOD_15vPlgAAANE"]
[Tue May 05 07:50:36.981598 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.102:52469] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/past.php"] [unique_id "afkwzHG_NPOxSH0O9aRD2QAAAVI"]
[Tue May 05 07:50:39.135365 2026] [:error] [pid 39071:tid 39083] [client 45.86.200.92:41063] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/edit-tags.php"] [unique_id "afkwz4vmnRMz9gRzix28OgAAAAM"]
[Tue May 05 07:50:42.161646 2026] [:error] [pid 39072:tid 39117] [client 45.86.200.75:35403] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/footer-default.php"] [unique_id "afkw0volSHl4aAnrIotODAAAAEo"]
[Tue May 05 07:50:43.008004 2026] [:error] [pid 39071:tid 39094] [client 45.86.200.81:62225] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-meta-request.php"] [unique_id "afkw04vmnRMz9gRzix28nwAAAA4"]
[Tue May 05 07:50:44.880385 2026] [:error] [pid 39071:tid 39082] [client 45.86.200.102:61297] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-widgets/bypass.php"] [unique_id "afkw1IvmnRMz9gRzix281QAAAAI"]
[Tue May 05 07:50:46.015754 2026] [:error] [pid 53856:tid 53887] [client 45.86.200.101:58515] [client 45.86.200.101] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/wp-login.php"] [unique_id "afkw1nG_NPOxSH0O9aRFwQAAAVY"]
[Tue May 05 07:50:48.793582 2026] [:error] [pid 39071:tid 39083] [client 45.86.200.102:54499] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-ss.php"] [unique_id "afkw2IvmnRMz9gRzix29PgAAAAM"]
[Tue May 05 07:50:50.357580 2026] [:error] [pid 39178:tid 39184] [client 45.86.200.55:45931] [client 45.86.200.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/xsec1.php"] [unique_id "afkw2jaPrgTaiOD_15vQhQAAAMQ"]
[Tue May 05 07:50:51.855011 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.103:42535] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/crystal/sad.php"] [unique_id "afkw2zaPrgTaiOD_15vQuQAAANE"]
[Tue May 05 07:50:53.405348 2026] [:error] [pid 39071:tid 39085] [client 45.86.200.77:40737] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-packages.min.php"] [unique_id "afkw3YvmnRMz9gRzix29uAAAAAU"]
[Tue May 05 07:50:54.539137 2026] [:error] [pid 53856:tid 53874] [client 45.86.200.110:24437] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-phpmailer-beta.php"] [unique_id "afkw3nG_NPOxSH0O9aRHpQAAAUk"]
[Tue May 05 07:50:55.075558 2026] [:error] [pid 39073:tid 39142] [client 45.86.200.100:21567] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ms-file.php"] [unique_id "afkw3_0kT1BNjk46BkeKrAAAAIg"]
[Tue May 05 07:50:56.700443 2026] [:error] [pid 41055:tid 41080] [client 185.82.72.3:43401] [client 185.82.72.3] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 185.82.72.3, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/wp-login.php"] [unique_id "afkw4CepFwKgA_SKOHg0kAAAARY"]
[Tue May 05 07:50:56.750442 2026] [proxy_fcgi:error] [pid 41055:tid 41080] [client 185.82.72.3:43401] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:50:57.020710 2026] [:error] [pid 41055:tid 41081] [client 185.82.72.3:43401] [client 185.82.72.3] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/av.php"] [unique_id "afkw4SepFwKgA_SKOHg0ngAAARc"]
[Tue May 05 07:51:02.835173 2026] [:error] [pid 53856:tid 53878] [client 45.86.200.106:46923] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/autoload_classmap.php"] [unique_id "afkw5nG_NPOxSH0O9aRJYQAAAU0"]
[Tue May 05 07:51:03.395022 2026] [:error] [pid 53856:tid 53882] [client 45.86.200.59:45819] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/network.php"] [unique_id "afkw53G_NPOxSH0O9aRJjgAAAVE"]
[Tue May 05 07:51:06.949080 2026] [:error] [pid 39178:tid 39201] [client 45.86.200.106:53895] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/XML/content.php"] [unique_id "afkw6jaPrgTaiOD_15vSUQAAANU"]
[Tue May 05 07:51:07.486821 2026] [:error] [pid 41055:tid 41059] [client 45.86.200.53:29417] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/item.php"] [unique_id "afkw6yepFwKgA_SKOHg1ewAAAQE"]
[Tue May 05 07:51:09.700485 2026] [:error] [pid 53856:tid 53889] [client 185.82.72.4:52233] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/plugins.php"] [unique_id "afkw7XG_NPOxSH0O9aRK7AAAAVg"]
[Tue May 05 07:51:10.260735 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.54:20565] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/install.php"] [unique_id "afkw7nG_NPOxSH0O9aRLBAAAAVM"]
[Tue May 05 07:51:10.837716 2026] [proxy_fcgi:error] [pid 39073:tid 39138] [client 45.86.200.104:57787] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:51:11.108330 2026] [:error] [pid 39073:tid 39146] [client 45.86.200.104:57787] [client 45.86.200.104] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.104, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "afkw7_0kT1BNjk46BkeMmwAAAIw"]
[Tue May 05 07:51:11.654181 2026] [:error] [pid 39073:tid 39138] [client 45.86.200.104:57787] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-nav-widgets.php"] [unique_id "afkw7_0kT1BNjk46BkeMsQAAAIQ"]
[Tue May 05 07:51:13.023249 2026] [:error] [pid 39071:tid 39093] [client 45.86.200.86:38403] [client 45.86.200.86] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/doc.php"] [unique_id "afkw8YvmnRMz9gRzix2_5gAAAA0"]
[Tue May 05 07:51:13.849184 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.75:35077] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/1.php"] [unique_id "afkw8XG_NPOxSH0O9aRLmgAAAVA"]
[Tue May 05 07:51:14.409212 2026] [:error] [pid 39072:tid 39119] [client 45.86.200.104:53609] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/class_api.php"] [unique_id "afkw8volSHl4aAnrIotRIgAAAEw"]
[Tue May 05 07:51:15.825087 2026] [:error] [pid 53856:tid 53867] [client 45.86.200.104:40099] [client 45.86.200.104] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "afkw83G_NPOxSH0O9aRL2gAAAUI"]
[Tue May 05 07:51:16.934028 2026] [:error] [pid 41055:tid 41082] [client 45.86.200.98:38633] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "afkw9CepFwKgA_SKOHg2SgAAARg"]
[Tue May 05 07:51:18.612522 2026] [:error] [pid 41055:tid 41060] [client 45.86.200.98:35489] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-customize-manager-interpreter.php"] [unique_id "afkw9iepFwKgA_SKOHg2hgAAAQI"]
[Tue May 05 07:51:19.170739 2026] [:error] [pid 39073:tid 39156] [client 45.86.200.93:30059] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/bypass.php"] [unique_id "afkw9_0kT1BNjk46BkeNtwAAAJY"]
[Tue May 05 07:51:21.113617 2026] [:error] [pid 39178:tid 39180] [client 45.86.200.56:63547] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/count.php"] [unique_id "afkw-TaPrgTaiOD_15vTzAAAAMA"]
[Tue May 05 07:51:23.295653 2026] [:error] [pid 39072:tid 39114] [client 45.86.200.81:21899] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/chosen.php"] [unique_id "afkw-_olSHl4aAnrIotSbQAAAEc"]
[Tue May 05 07:51:24.394371 2026] [:error] [pid 39071:tid 39085] [client 45.86.200.78:57575] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 2). String match ".php" at REQUEST_FILENAME. [file "/usr/local/apache/modsecurity-cwaf/rules/24_Apps_Joomla.conf"] [line "74"] [id "240000"] [rev "1"] [msg "COMODO WAF: Protecting Joomla folder||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Joomla"] [hostname "paramountestate.com.au"] [uri "/images/stories/themes.php"] [unique_id "afkw_IvmnRMz9gRzix3BHgAAAAU"]
[Tue May 05 07:51:24.667657 2026] [:error] [pid 39071:tid 39092] [client 45.86.200.78:57575] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/footer-embed-function.php"] [unique_id "afkw_IvmnRMz9gRzix3BJAAAAAw"]
[Tue May 05 07:51:25.793392 2026] [:error] [pid 39178:tid 39198] [client 45.86.200.83:46131] [client 45.86.200.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-translation-file-mo-event.php"] [unique_id "afkw_TaPrgTaiOD_15vUQQAAANI"]
[Tue May 05 07:51:27.408977 2026] [:error] [pid 39071:tid 39104] [client 45.86.200.103:30823] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/vars-soap.php"] [unique_id "afkw_4vmnRMz9gRzix3BVAAAABg"]
[Tue May 05 07:51:29.617717 2026] [:error] [pid 53856:tid 53888] [client 45.86.200.96:57731] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/id3/wp-work.php"] [unique_id "afkxAXG_NPOxSH0O9aRNcgAAAVc"]
[Tue May 05 07:51:30.737119 2026] [:error] [pid 39071:tid 39095] [client 45.86.200.87:24879] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-taxonomy.editor.php"] [unique_id "afkxAovmnRMz9gRzix3BtQAAAA8"]
[Tue May 05 07:51:31.551326 2026] [:error] [pid 39072:tid 39128] [client 45.86.200.98:63519] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/wp-conflg.php"] [unique_id "afkxA_olSHl4aAnrIotTYQAAAFU"]
[Tue May 05 07:51:33.509810 2026] [:error] [pid 39178:tid 39198] [client 45.86.200.55:28231] [client 45.86.200.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/interactivity-api-xml.php"] [unique_id "afkxBTaPrgTaiOD_15vVMQAAANI"]
[Tue May 05 07:51:34.057424 2026] [:error] [pid 39072:tid 39110] [client 45.86.200.80:39493] [client 45.86.200.80] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/colour.php"] [unique_id "afkxBvolSHl4aAnrIotTvgAAAEM"]
[Tue May 05 07:51:35.913313 2026] [:error] [pid 39072:tid 39107] [client 45.86.200.92:62585] [client 45.86.200.92] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-background-position-control-variable.php"] [unique_id "afkxB_olSHl4aAnrIotUDQAAAEA"]
[Tue May 05 07:51:36.530919 2026] [:error] [pid 39178:tid 39193] [client 45.86.200.74:49989] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/include.php"] [unique_id "afkxCDaPrgTaiOD_15vVkAAAAM0"]
[Tue May 05 07:51:37.622503 2026] [:error] [pid 39071:tid 39085] [client 45.86.200.85:39311] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/imgareaselect/wp-login.php"] [unique_id "afkxCYvmnRMz9gRzix3CdAAAAAU"]
[Tue May 05 07:51:38.770611 2026] [:error] [pid 53856:tid 53878] [client 45.86.200.99:40363] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/class-wp-translations-interface.php"] [unique_id "afkxCnG_NPOxSH0O9aROigAAAU0"]
[Tue May 05 07:51:39.315103 2026] [:error] [pid 39178:tid 39184] [client 45.86.200.103:47341] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/about5.php"] [unique_id "afkxCzaPrgTaiOD_15vV5gAAAMQ"]
[Tue May 05 07:51:40.407053 2026] [:error] [pid 39072:tid 39131] [client 45.86.200.103:37183] [client 45.86.200.103] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/js/db.php"] [unique_id "afkxDPolSHl4aAnrIotU6gAAAFg"]
[Tue May 05 07:51:42.571587 2026] [:error] [pid 41055:tid 41073] [client 45.86.200.75:39433] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/db.php"] [unique_id "afkxDiepFwKgA_SKOHg5vgAAAQ8"]
[Tue May 05 07:51:44.766898 2026] [:error] [pid 39072:tid 39120] [client 45.86.200.110:36745] [client 45.86.200.110] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/bypass.php"] [unique_id "afkxEPolSHl4aAnrIotVoQAAAE0"]
[Tue May 05 07:51:46.141299 2026] [:error] [pid 41055:tid 41065] [client 45.86.200.87:53395] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/wp-conflg.php"] [unique_id "afkxEiepFwKgA_SKOHg6JwAAAQc"]
[Tue May 05 07:51:46.708284 2026] [:error] [pid 39071:tid 39100] [client 45.86.200.85:57461] [client 45.86.200.85] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wp-includes/assets/script-loader-packages.php"] [unique_id "afkxEovmnRMz9gRzix3DMgAAABQ"]
[Tue May 05 07:51:48.300098 2026] [:error] [pid 39072:tid 39118] [client 45.86.200.81:42227] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/login.php"] [unique_id "afkxFPolSHl4aAnrIotWDQAAAEs"]
[Tue May 05 07:51:49.403831 2026] [:error] [pid 53856:tid 53886] [client 45.86.200.109:28269] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/chosen.php"] [unique_id "afkxFXG_NPOxSH0O9aRPtgAAAVU"]
[Tue May 05 07:51:51.541899 2026] [:error] [pid 39071:tid 39088] [client 45.86.200.102:45645] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Cache/index.php"] [unique_id "afkxF4vmnRMz9gRzix3DlQAAAAg"]
[Tue May 05 07:51:53.113807 2026] [:error] [pid 41055:tid 41061] [client 45.86.200.56:31587] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/about.php"] [unique_id "afkxGSepFwKgA_SKOHg67AAAAQM"]
[Tue May 05 07:51:53.921113 2026] [:error] [pid 39178:tid 39186] [client 45.86.200.94:59167] [client 45.86.200.94] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "afkxGTaPrgTaiOD_15vXvgAAAMY"]
[Tue May 05 07:51:54.463931 2026] [:error] [pid 53856:tid 53875] [client 45.86.200.74:25165] [client 45.86.200.74] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/simi.php"] [unique_id "afkxGnG_NPOxSH0O9aRQTgAAAUo"]
[Tue May 05 07:51:55.594358 2026] [:error] [pid 39072:tid 39120] [client 45.86.200.91:48681] [client 45.86.200.91] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/Text/index.php"] [unique_id "afkxG_olSHl4aAnrIotW7AAAAE0"]
[Tue May 05 07:51:57.586512 2026] [:error] [pid 39178:tid 39185] [client 45.86.200.79:60705] [client 45.86.200.79] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/abcd.php"] [unique_id "afkxHTaPrgTaiOD_15vYQAAAAMU"]
[Tue May 05 07:51:58.121458 2026] [:error] [pid 39072:tid 39129] [client 45.86.200.96:44061] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/rk2.php"] [unique_id "afkxHvolSHl4aAnrIotXSAAAAFY"]
[Tue May 05 07:51:58.688336 2026] [:error] [pid 39072:tid 39122] [client 45.86.200.87:29919] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-widget-search-interpreter.php"] [unique_id "afkxHvolSHl4aAnrIotXWwAAAE8"]
[Tue May 05 07:51:59.811286 2026] [:error] [pid 53856:tid 53878] [client 45.86.200.97:29739] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-template-utils-other.php"] [unique_id "afkxH3G_NPOxSH0O9aRRKAAAAU0"]
[Tue May 05 07:52:02.067270 2026] [:error] [pid 39073:tid 39144] [client 45.86.200.90:50715] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/lib/widget-group.php"] [unique_id "afkxIv0kT1BNjk46BkeS7gAAAIo"]
[Tue May 05 07:52:02.949819 2026] [:error] [pid 39073:tid 39151] [client 45.86.200.81:38167] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jcrop/about.php"] [unique_id "afkxIv0kT1BNjk46BkeTCQAAAJE"]
[Tue May 05 07:52:03.780807 2026] [:error] [pid 39071:tid 39097] [client 45.86.200.77:48111] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "afkxI4vmnRMz9gRzix3EWwAAABE"]
[Tue May 05 07:52:05.646328 2026] [:error] [pid 39072:tid 39130] [client 185.82.72.4:38863] [client 185.82.72.4] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/media-new.php"] [unique_id "afkxJfolSHl4aAnrIotYZwAAAFc"]
[Tue May 05 07:52:07.580504 2026] [:error] [pid 39178:tid 39188] [client 45.86.200.84:60263] [client 45.86.200.84] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/plugin.php"] [unique_id "afkxJzaPrgTaiOD_15vZWwAAAMg"]
[Tue May 05 07:52:08.160743 2026] [:error] [pid 39071:tid 39092] [client 45.86.200.54:41793] [client 45.86.200.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-scripts-query.php"] [unique_id "afkxKIvmnRMz9gRzix3EtwAAAAw"]
[Tue May 05 07:52:09.251296 2026] [:error] [pid 41055:tid 41082] [client 45.86.200.55:61517] [client 45.86.200.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/module.audio-license.php"] [unique_id "afkxKSepFwKgA_SKOHg8jAAAARg"]
[Tue May 05 07:52:11.914270 2026] [:error] [pid 41055:tid 41070] [client 45.86.200.93:52065] [client 45.86.200.93] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-error-module.php"] [unique_id "afkxKyepFwKgA_SKOHg89gAAAQw"]
[Tue May 05 07:52:13.002160 2026] [:error] [pid 39073:tid 39137] [client 45.86.200.107:37459] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/litespeed.php"] [unique_id "afkxLf0kT1BNjk46BkeUJQAAAIM"]
[Tue May 05 07:52:14.138122 2026] [:error] [pid 53856:tid 53881] [client 45.86.200.108:23999] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/alam.php"] [unique_id "afkxLnG_NPOxSH0O9aRTkQAAAVA"]
[Tue May 05 07:52:14.994575 2026] [:error] [pid 39072:tid 39123] [client 45.86.200.107:64793] [client 45.86.200.107] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/imagess.php"] [unique_id "afkxLvolSHl4aAnrIotZyAAAAFA"]
[Tue May 05 07:52:15.817096 2026] [:error] [pid 39071:tid 39083] [client 45.86.200.90:45369] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/default-filters-edit.php"] [unique_id "afkxL4vmnRMz9gRzix3FYgAAAAM"]
[Tue May 05 07:52:17.519655 2026] [:error] [pid 39178:tid 39197] [client 45.86.200.51:31607] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/Auth/index.php"] [unique_id "afkxMTaPrgTaiOD_15vaaAAAANE"]
[Tue May 05 07:52:18.924529 2026] [:error] [pid 41055:tid 41081] [client 45.86.200.53:43319] [client 45.86.200.53] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/theme.php"] [unique_id "afkxMiepFwKgA_SKOHg92wAAARc"]
[Tue May 05 07:52:19.491306 2026] [proxy_fcgi:error] [pid 53856:tid 53879] [client 45.86.200.59:53929] AH01071: Got error 'Primary script unknown'
[Tue May 05 07:52:19.774868 2026] [:error] [pid 53856:tid 53883] [client 45.86.200.59:53929] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/shell.php"] [unique_id "afkxM3G_NPOxSH0O9aRUWQAAAVI"]
[Tue May 05 07:52:20.322123 2026] [:error] [pid 39071:tid 39104] [client 45.86.200.83:22817] [client 45.86.200.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-selective-refresh-library.php"] [unique_id "afkxNIvmnRMz9gRzix3FwQAAABg"]
[Tue May 05 07:52:22.483064 2026] [:error] [pid 39178:tid 39203] [client 45.86.200.51:26519] [client 45.86.200.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/library/wp-login.php"] [unique_id "afkxNjaPrgTaiOD_15va4wAAANc"]
[Tue May 05 07:52:23.012940 2026] [:error] [pid 39178:tid 39186] [client 45.86.200.98:50307] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/about.php"] [unique_id "afkxNzaPrgTaiOD_15va8QAAAMY"]
[Tue May 05 07:52:25.211634 2026] [:error] [pid 39071:tid 39084] [client 45.86.200.102:27077] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-2019.php"] [unique_id "afkxOYvmnRMz9gRzix3GPQAAAAQ"]
[Tue May 05 07:52:25.752999 2026] [:error] [pid 39071:tid 39082] [client 45.86.200.95:59359] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/info.php"] [unique_id "afkxOYvmnRMz9gRzix3GSwAAAAI"]
[Tue May 05 07:52:26.585994 2026] [:error] [pid 41055:tid 41060] [client 45.86.200.89:61337] [client 45.86.200.89] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/log.php"] [unique_id "afkxOiepFwKgA_SKOHg-0gAAAQI"]
[Tue May 05 07:52:27.133346 2026] [:error] [pid 39072:tid 39118] [client 45.86.200.111:58929] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-runtime-num.php"] [unique_id "afkxO_olSHl4aAnrIotbswAAAEs"]
[Tue May 05 07:52:27.691537 2026] [:error] [pid 53856:tid 53884] [client 45.86.200.97:34119] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh-entry.min-object.php"] [unique_id "afkxO3G_NPOxSH0O9aRVZwAAAVM"]
[Tue May 05 07:52:28.232150 2026] [:error] [pid 39071:tid 39086] [client 45.86.200.112:48885] [client 45.86.200.112] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/aw.php"] [unique_id "afkxPIvmnRMz9gRzix3GhAAAAAY"]
[Tue May 05 07:52:30.001583 2026] [:error] [pid 39178:tid 39201] [client 45.86.200.100:31847] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/db.php"] [unique_id "afkxPTaPrgTaiOD_15vbvQAAANU"]
[Tue May 05 07:52:31.630937 2026] [:error] [pid 53856:tid 53875] [client 45.86.200.81:57479] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/install.php"] [unique_id "afkxP3G_NPOxSH0O9aRV2QAAAUo"]
[Tue May 05 07:52:32.726578 2026] [:error] [pid 53856:tid 53871] [client 45.86.200.98:53839] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/install.php"] [unique_id "afkxQHG_NPOxSH0O9aRWBAAAAUY"]
[Tue May 05 07:52:33.271324 2026] [:error] [pid 53856:tid 53880] [client 45.86.200.81:21529] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/dedi1.php"] [unique_id "afkxQXG_NPOxSH0O9aRWGAAAAU8"]
[Tue May 05 07:52:34.374058 2026] [:error] [pid 39071:tid 39103] [client 45.86.200.59:38531] [client 45.86.200.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/template-less.php"] [unique_id "afkxQovmnRMz9gRzix3HFgAAABc"]
[Tue May 05 07:52:34.916187 2026] [:error] [pid 39072:tid 39131] [client 45.86.200.103:65245] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/alfa-rex.php"] [unique_id "afkxQvolSHl4aAnrIotc0gAAAFg"]
[Tue May 05 07:52:37.525480 2026] [:error] [pid 39178:tid 39184] [client 45.86.200.108:20709] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/min.php"] [unique_id "afkxRTaPrgTaiOD_15vccQAAAMQ"]
[Tue May 05 07:52:38.088716 2026] [:error] [pid 39073:tid 39151] [client 45.86.200.76:34839] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "afkxRv0kT1BNjk46BkeWuQAAAJE"]
[Tue May 05 07:52:39.171630 2026] [:error] [pid 53856:tid 53880] [client 45.86.200.60:58593] [client 45.86.200.60] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/file.php"] [unique_id "afkxR3G_NPOxSH0O9aRXOQAAAU8"]
[Tue May 05 07:52:39.991497 2026] [:error] [pid 41055:tid 41071] [client 45.86.200.56:53157] [client 45.86.200.56] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "afkxRyepFwKgA_SKOHhAgAAAAQ0"]
[Tue May 05 07:52:41.958537 2026] [:error] [pid 39073:tid 39141] [client 45.86.200.100:61905] [client 45.86.200.100] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/load.php"] [unique_id "afkxSf0kT1BNjk46BkeXBgAAAIc"]
[Tue May 05 07:52:42.506396 2026] [:error] [pid 39073:tid 39157] [client 45.86.200.83:58245] [client 45.86.200.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/chosen.php"] [unique_id "afkxSv0kT1BNjk46BkeXEwAAAJc"]
[Tue May 05 07:52:43.066129 2026] [:error] [pid 39071:tid 39086] [client 185.82.72.4:39563] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-theme-float.php"] [unique_id "afkxS4vmnRMz9gRzix3H_wAAAAY"]
[Tue May 05 07:52:44.441834 2026] [:error] [pid 41055:tid 41073] [client 45.86.200.97:46319] [client 45.86.200.97] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/wp-style.php"] [unique_id "afkxTCepFwKgA_SKOHhBHwAAAQ8"]
[Tue May 05 07:52:45.311112 2026] [:error] [pid 39178:tid 39185] [client 45.86.200.77:59721] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/autoload_classmap.php"] [unique_id "afkxTTaPrgTaiOD_15vdDAAAAMU"]
[Tue May 05 07:52:47.478025 2026] [:error] [pid 53856:tid 53873] [client 45.86.200.108:25151] [client 45.86.200.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/admin.php"] [unique_id "afkxT3G_NPOxSH0O9aRYngAAAUg"]
[Tue May 05 07:52:48.010128 2026] [:error] [pid 39178:tid 39186] [client 185.82.72.4:48531] [client 185.82.72.4] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/autoload_classmap.php"] [unique_id "afkxUDaPrgTaiOD_15vdSQAAAMY"]
[Tue May 05 07:52:48.547924 2026] [:error] [pid 39073:tid 39155] [client 45.86.200.95:39875] [client 45.86.200.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/db.php"] [unique_id "afkxUP0kT1BNjk46BkeXsAAAAJU"]
[Tue May 05 07:52:51.459392 2026] [:error] [pid 39071:tid 39101] [client 45.86.200.98:38099] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/system.php"] [unique_id "afkxU4vmnRMz9gRzix3I_QAAABU"]
[Tue May 05 07:52:53.330745 2026] [:error] [pid 39072:tid 39130] [client 45.86.200.73:52225] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/about.php"] [unique_id "afkxVfolSHl4aAnrIotevQAAAFc"]
[Tue May 05 07:52:54.454579 2026] [:error] [pid 39178:tid 39195] [client 45.86.200.109:63201] [client 45.86.200.109] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-upload-control-cookie.php"] [unique_id "afkxVjaPrgTaiOD_15vdywAAAM8"]
[Tue May 05 07:52:57.971947 2026] [:error] [pid 39072:tid 39109] [client 45.86.200.78:63857] [client 45.86.200.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/simi.php"] [unique_id "afkxWfolSHl4aAnrIotfSgAAAEI"]
[Tue May 05 07:52:58.514592 2026] [:error] [pid 39178:tid 39204] [client 45.86.200.75:60697] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-taxonomy-sample.php"] [unique_id "afkxWjaPrgTaiOD_15veIAAAANg"]
[Tue May 05 07:52:59.616381 2026] [:error] [pid 41055:tid 41066] [client 45.86.200.83:54129] [client 45.86.200.83] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "afkxWyepFwKgA_SKOHhCjwAAAQg"]
[Tue May 05 07:53:02.198994 2026] [:error] [pid 41055:tid 41058] [client 45.86.200.81:64085] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ms-pie.php"] [unique_id "afkxXiepFwKgA_SKOHhC0QAAAQA"]
[Tue May 05 07:53:03.844447 2026] [:error] [pid 41055:tid 41060] [client 45.86.200.96:43057] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/index.php"] [unique_id "afkxXyepFwKgA_SKOHhDAgAAAQI"]
[Tue May 05 07:53:04.927337 2026] [:error] [pid 41055:tid 41082] [client 45.86.200.57:43257] [client 45.86.200.57] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/nav-menu.php"] [unique_id "afkxYCepFwKgA_SKOHhDIQAAARg"]
[Tue May 05 07:53:05.483249 2026] [:error] [pid 39073:tid 39138] [client 45.86.200.87:30931] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/user.php"] [unique_id "afkxYf0kT1BNjk46BkeZ4gAAAIQ"]
[Tue May 05 07:53:09.133211 2026] [:error] [pid 39178:tid 39185] [client 45.86.200.106:34839] [client 45.86.200.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/search/about.php"] [unique_id "afkxZTaPrgTaiOD_15vfFQAAAMU"]
[Tue May 05 07:53:09.667361 2026] [:error] [pid 39178:tid 39202] [client 45.86.200.76:30339] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/class-wp-customize-cropped-image-control.php"] [unique_id "afkxZTaPrgTaiOD_15vfHwAAANY"]
[Tue May 05 07:53:11.259414 2026] [:error] [pid 53856:tid 53886] [client 45.86.200.73:40605] [client 45.86.200.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/ultra.php"] [unique_id "afkxZ3G_NPOxSH0O9aRcegAAAVU"]
[Tue May 05 07:53:12.103522 2026] [:error] [pid 39178:tid 39198] [client 45.86.200.76:58297] [client 45.86.200.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.86.200.76, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/classic-editor/wp-login.php"] [unique_id "afkxaDaPrgTaiOD_15vfTgAAANI"]
[Tue May 05 07:53:12.661351 2026] [:error] [pid 39178:tid 39196] [client 45.86.200.76:58297] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/preferences/wp-login.php"] [unique_id "afkxaDaPrgTaiOD_15vfWgAAANA"]
[Tue May 05 07:53:13.230919 2026] [:error] [pid 41055:tid 41064] [client 45.86.200.75:54325] [client 45.86.200.75] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/media-text/index.php"] [unique_id "afkxaSepFwKgA_SKOHhEBwAAAQY"]
[Tue May 05 07:53:13.783984 2026] [:error] [pid 39178:tid 39201] [client 45.86.200.55:27141] [client 45.86.200.55] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/phpmailer/phpmailer.php"] [unique_id "afkxaTaPrgTaiOD_15vfdAAAANU"]
[Tue May 05 07:53:16.041420 2026] [:error] [pid 53856:tid 53878] [client 45.86.200.90:23391] [client 45.86.200.90] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/latest-comments/template-loader.php"] [unique_id "afkxbHG_NPOxSH0O9aRdUgAAAU0"]
[Tue May 05 07:53:19.788314 2026] [:error] [pid 39178:tid 39193] [client 45.86.200.102:45047] [client 45.86.200.102] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/nextpage/index.php"] [unique_id "afkxbzaPrgTaiOD_15vgMQAAAM0"]
[Tue May 05 07:53:20.923133 2026] [:error] [pid 39071:tid 39088] [client 45.86.200.87:30297] [client 45.86.200.87] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/link-template-firewall.php"] [unique_id "afkxcIvmnRMz9gRzix3M5wAAAAg"]
[Tue May 05 07:53:24.753642 2026] [:error] [pid 41055:tid 41080] [client 45.86.200.77:46507] [client 45.86.200.77] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "afkxdCepFwKgA_SKOHhFaQAAARY"]
[Tue May 05 07:53:25.320672 2026] [:error] [pid 39178:tid 39186] [client 45.86.200.99:25459] [client 45.86.200.99] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/src/Decode/HTML/sitemaps.php"] [unique_id "afkxdTaPrgTaiOD_15vgvQAAAMY"]
[Tue May 05 07:53:25.860250 2026] [:error] [pid 39178:tid 39200] [client 45.86.200.105:58635] [client 45.86.200.105] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/mer_gagal.php"] [unique_id "afkxdTaPrgTaiOD_15vgzwAAANQ"]
[Tue May 05 07:53:26.395355 2026] [:error] [pid 53856:tid 53879] [client 45.86.200.81:58029] [client 45.86.200.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/wp-login.php"] [unique_id "afkxdnG_NPOxSH0O9aRexwAAAU4"]
[Tue May 05 07:53:27.738135 2026] [:error] [pid 53856:tid 53885] [client 45.86.200.111:58831] [client 45.86.200.111] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/alfa-rex.php"] [unique_id "afkxd3G_NPOxSH0O9aRfBgAAAVQ"]
[Tue May 05 07:53:28.280536 2026] [:error] [pid 39073:tid 39152] [client 45.86.200.103:49267] [client 45.86.200.103] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/Core32.php"] [unique_id "afkxeP0kT1BNjk46BkecegAAAJI"]
[Tue May 05 07:53:30.238789 2026] [:error] [pid 39072:tid 39114] [client 45.86.200.96:25305] [client 45.86.200.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-conflg.php"] [unique_id "afkxevolSHl4aAnrIotjEwAAAEc"]
[Tue May 05 07:53:31.863565 2026] [:error] [pid 39178:tid 39189] [client 45.86.200.98:41189] [client 45.86.200.98] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "afkxezaPrgTaiOD_15vhZQAAAMk"]
[Tue May 05 07:53:32.410787 2026] [:error] [pid 39071:tid 39090] [client 45.86.200.76:36031] [client 45.86.200.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/library/index.php"] [unique_id "afkxfIvmnRMz9gRzix3OEAAAAAo"]
[Tue May 05 14:57:28.916888 2026] [:error] [pid 25835:tid 25857] [client 35.242.169.171:54576] [client 35.242.169.171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "afmU2FDT5nGJyh1439yYUwAAARQ"]
[Tue May 05 15:30:04.254638 2026] [:error] [pid 25744:tid 25779] [client 34.17.72.171:44890] [client 34.17.72.171] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "afmcfCR8IuyzjkW06OOx0wAAAIU"]
[Tue May 05 22:15:01.394677 2026] [:error] [pid 54732:tid 54752] [client 194.62.107.4:26663] [client 194.62.107.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "afn7ZbGgYlDOb3nfuJQzBgAAAFI"]
[Wed May 06 00:53:05.348087 2026] [:error] [pid 25744:tid 25786] [client 38.95.35.79:57368] [client 38.95.35.79] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 38.95.35.79, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "afogcSR8IuyzjkW06OMlHgAAAIw"]
[Wed May 06 00:53:06.307133 2026] [:error] [pid 25744:tid 25775] [client 38.95.35.79:57380] [client 38.95.35.79] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 38.95.35.79, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afogciR8IuyzjkW06OMlIQAAAIE"]
[Wed May 06 02:56:43.907084 2026] [:error] [pid 25744:tid 25782] [client 20.151.0.198:58972] [client 20.151.0.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "afo9ayR8IuyzjkW06OM9cAAAAIg"]
[Wed May 06 02:57:31.662130 2026] [:error] [pid 2324:tid 2339] [client 20.151.0.198:59001] [client 20.151.0.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "afo9m2qe2hrcI52A1Hz95gAAAU0"]
[Wed May 06 02:57:36.773250 2026] [:error] [pid 2324:tid 2346] [client 20.151.0.198:58894] [client 20.151.0.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "afo9oGqe2hrcI52A1Hz99QAAAVQ"]
[Wed May 06 02:57:39.878907 2026] [:error] [pid 54732:tid 54740] [client 20.151.0.198:58973] [client 20.151.0.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "afo9o7GgYlDOb3nfuJRiAgAAAEY"]
[Wed May 06 02:57:42.812690 2026] [:error] [pid 54732:tid 54749] [client 20.151.0.198:58980] [client 20.151.0.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "afo9prGgYlDOb3nfuJRiCAAAAE8"]
[Wed May 06 02:57:45.690424 2026] [proxy_fcgi:error] [pid 2324:tid 2334] [client 20.151.0.198:58981] AH01071: Got error 'Primary script unknown'
[Wed May 06 02:57:50.422337 2026] [:error] [pid 2324:tid 2329] [client 20.151.0.198:58981] [client 20.151.0.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "afo9rmqe2hrcI52A1Hz-IAAAAUM"]
[Wed May 06 02:57:57.279115 2026] [:error] [pid 25835:tid 25853] [client 20.151.0.198:58907] [client 20.151.0.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "afo9tVDT5nGJyh1439wXCAAAARA"]
[Wed May 06 02:58:01.727064 2026] [:error] [pid 25744:tid 25786] [client 20.151.0.198:58974] [client 20.151.0.198] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "afo9uSR8IuyzjkW06OM9tAAAAIw"]
[Wed May 06 09:57:32.973723 2026] [:error] [pid 9664:tid 9783] [client 138.204.210.183:38818] [client 138.204.210.183] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 138.204.210.183, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afqgDAH4OZbrg1SjsBPk9AAAAJU"]
[Wed May 06 10:29:29.272857 2026] [:error] [pid 9789:tid 9804] [client 134.199.235.168:58046] [client 134.199.235.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.199.235.168, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "afqniT_YStPJSCHPkUUmfwAAAE0"]
[Wed May 06 10:29:30.000562 2026] [:error] [pid 9789:tid 9797] [client 134.199.235.168:58446] [client 134.199.235.168] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 134.199.235.168, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "afqniT_YStPJSCHPkUUmgQAAAEY"]
[Wed May 06 11:08:54.799791 2026] [:error] [pid 9664:tid 9779] [client 188.166.84.114:65148] [client 188.166.84.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.166.84.114, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "afqwxgH4OZbrg1SjsBP49AAAAJE"]
[Wed May 06 11:08:55.830082 2026] [:error] [pid 9659:tid 9734] [client 188.166.84.114:59762] [client 188.166.84.114] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 188.166.84.114, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "afqwx_wJnWjd8JHpBttUggAAAMA"]
[Wed May 06 20:49:12.783612 2026] [:error] [pid 482:tid 492] [client 52.138.31.126:17407] [client 52.138.31.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "afs4yMxs8HOc_nWgOW5RfQAAAcg"]
[Wed May 06 20:50:19.331592 2026] [:error] [pid 9653:tid 9705] [client 52.138.31.126:17375] [client 52.138.31.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/nss.php"] [unique_id "afs5C6hJ49Xc4dqq0B4N-gAAAAc"]
[Wed May 06 20:50:51.598472 2026] [:error] [pid 482:tid 495] [client 52.138.31.126:17300] [client 52.138.31.126] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afs5K8xs8HOc_nWgOW5SGwAAAcs"]
[Wed May 06 20:51:17.836042 2026] [:error] [pid 9659:tid 9754] [client 20.9.31.235:61898] [client 20.9.31.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "afs5RfwJnWjd8JHpBtuSHwAAANQ"]
[Wed May 06 20:52:00.464702 2026] [:error] [pid 9653:tid 9717] [client 20.9.31.235:61878] [client 20.9.31.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/nss.php"] [unique_id "afs5cKhJ49Xc4dqq0B4O1wAAABM"]
[Wed May 06 20:52:32.585124 2026] [:error] [pid 13443:tid 13456] [client 20.9.31.235:61857] [client 20.9.31.235] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "afs5kACyfZallDmsQrebbAAAAUs"]
[Thu May 07 00:08:57.665414 2026] [:error] [pid 9653:tid 9701] [client 167.88.166.237:51380] [client 167.88.166.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aftnmahJ49Xc4dqq0B5NdgAAAAM"]
[Thu May 07 00:09:03.778580 2026] [:error] [pid 13443:tid 13462] [client 167.88.166.237:52208] [client 167.88.166.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/core/.env"] [unique_id "aftnnwCyfZallDmsQrerQgAAAVE"]
[Thu May 07 00:09:06.089689 2026] [:error] [pid 9659:tid 9747] [client 167.88.166.237:52388] [client 167.88.166.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/vendor/.env"] [unique_id "aftnovwJnWjd8JHpBtupJwAAAM0"]
[Thu May 07 00:09:08.469877 2026] [:error] [pid 482:tid 502] [client 167.88.166.237:52573] [client 167.88.166.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/assets/.env"] [unique_id "aftnpMxs8HOc_nWgOW6BeAAAAdI"]
[Thu May 07 00:09:11.085371 2026] [:error] [pid 9653:tid 9704] [client 167.88.166.237:52773] [client 167.88.166.237] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/storage/.env"] [unique_id "aftnp6hJ49Xc4dqq0B5NlQAAAAY"]
[Thu May 07 02:40:25.585816 2026] [:error] [pid 13414:tid 13430] [client 194.5.83.51:48847] [client 194.5.83.51] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 194.5.83.51, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afuLGUuJQpWjVpJTu_lFnwAAAQ4"]
[Thu May 07 05:01:12.050090 2026] [:error] [pid 29710:tid 29728] [client 20.104.207.18:62196] [client 20.104.207.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/options.php"] [unique_id "afusGP0atTQld9Y2ht_OhAAAANA"]
[Thu May 07 05:01:17.560751 2026] [:error] [pid 29605:tid 29617] [client 20.104.207.18:61437] [client 20.104.207.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "afusHYnxrTjETioEY0TXLgAAAAM"]
[Thu May 07 05:01:23.725729 2026] [:error] [pid 29605:tid 29624] [client 20.104.207.18:62165] [client 20.104.207.18] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/wp-login.php"] [unique_id "afusI4nxrTjETioEY0TXQAAAAAo"]
[Thu May 07 06:28:02.699757 2026] [:error] [pid 29710:tid 29736] [client 34.42.103.3:51434] [client 34.42.103.3] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "afvAcv0atTQld9Y2ht_zMwAAANg"]
[Thu May 07 13:55:43.726336 2026] [:error] [pid 56056:tid 56095] [client 195.178.110.241:55680] [client 195.178.110.241] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "afwpXwMt_VAuBmZ2nR934AAAAUg"]
[Thu May 07 19:10:30.112389 2026] [:error] [pid 28098:tid 28105] [client 85.203.23.201:55349] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "afxzJsvhwfljlt8trSrbOQAAAEU"]
[Thu May 07 19:10:35.301808 2026] [:error] [pid 15631:tid 15708] [client 85.203.23.192:60003] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "afxzK3vP1GkPUuuLfqUzWwAAANU"]
[Thu May 07 19:10:35.517431 2026] [:error] [pid 28098:tid 28110] [client 85.203.23.191:21993] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "afxzK8vhwfljlt8trSrbWQAAAEo"]
[Thu May 07 19:10:35.704943 2026] [:error] [pid 15715:tid 15741] [client 85.203.23.223:56417] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/users.php"] [unique_id "afxzKyY4dZsLOttMkceTlgAAARU"]
[Thu May 07 19:10:35.902728 2026] [:error] [pid 15630:tid 15667] [client 85.203.23.181:63689] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/adminfuns.php"] [unique_id "afxzK3TithRAi4821qus4wAAAIc"]
[Thu May 07 19:10:36.104190 2026] [:error] [pid 15631:tid 15703] [client 85.203.23.166:55845] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403.php"] [unique_id "afxzLHvP1GkPUuuLfqUzXAAAANA"]
[Thu May 07 19:10:36.316972 2026] [:error] [pid 15631:tid 15693] [client 85.203.23.200:44923] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/"] [unique_id "afxzLHvP1GkPUuuLfqUzXQAAAMY"]
[Thu May 07 19:10:36.516070 2026] [:error] [pid 28098:tid 28116] [client 85.203.23.202:31455] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "afxzLMvhwfljlt8trSrbYAAAAFA"]
[Thu May 07 19:10:41.714842 2026] [:error] [pid 15715:tid 15723] [client 85.203.23.189:43127] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/goods.php"] [unique_id "afxzMSY4dZsLOttMkceTvgAAAQY"]
[Thu May 07 19:10:46.919689 2026] [:error] [pid 15631:tid 15701] [client 85.203.23.222:34143] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/"] [unique_id "afxzNnvP1GkPUuuLfqUzbQAAAM4"]
[Thu May 07 19:10:47.135648 2026] [:error] [pid 28098:tid 28120] [client 85.203.23.170:44777] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-json/wp/v2/posts"] [unique_id "afxzN8vhwfljlt8trSrbnQAAAFQ"]
[Thu May 07 19:10:47.317908 2026] [:error] [pid 28098:tid 28107] [client 85.203.23.192:61219] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/"] [unique_id "afxzN8vhwfljlt8trSrbnwAAAEc"]
[Thu May 07 19:10:47.500066 2026] [:error] [pid 28098:tid 28123] [client 85.203.23.215:39873] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/admin.php"] [unique_id "afxzN8vhwfljlt8trSrbogAAAFc"]
[Thu May 07 19:10:57.732450 2026] [:error] [pid 15630:tid 15667] [client 85.203.23.220:26563] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/item.php"] [unique_id "afxzQXTithRAi4821qus-gAAAIc"]
[Thu May 07 19:10:57.921776 2026] [:error] [pid 15630:tid 15678] [client 85.203.23.188:30231] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hello-plus/classes/ehp-sarang.php"] [unique_id "afxzQXTithRAi4821qus-wAAAJI"]
[Thu May 07 19:10:58.112916 2026] [:error] [pid 15630:tid 15663] [client 85.203.23.199:52419] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "afxzQnTithRAi4821qus_QAAAIM"]
[Thu May 07 19:11:03.318842 2026] [:error] [pid 15630:tid 15671] [client 85.203.23.225:39991] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/admin/"] [unique_id "afxzR3TithRAi4821qutAQAAAIs"]
[Thu May 07 19:11:03.510138 2026] [:error] [pid 15715:tid 15738] [client 85.203.23.220:25599] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/404.php"] [unique_id "afxzRyY4dZsLOttMkceT4gAAARI"]
[Thu May 07 19:11:03.718045 2026] [:error] [pid 15630:tid 15679] [client 85.203.23.211:47757] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/edit-tags.php"] [unique_id "afxzR3TithRAi4821qutAgAAAJM"]
[Thu May 07 19:11:03.915535 2026] [:error] [pid 15631:tid 15708] [client 85.203.23.201:54459] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/system.php"] [unique_id "afxzR3vP1GkPUuuLfqUziQAAANU"]
[Thu May 07 19:11:04.104870 2026] [:error] [pid 15631:tid 15710] [client 85.203.23.211:52015] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/"] [unique_id "afxzSHvP1GkPUuuLfqUzjAAAANc"]
[Thu May 07 19:11:09.443032 2026] [:error] [pid 15715:tid 15719] [client 85.203.23.208:39327] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-wlx.php"] [unique_id "afxzTSY4dZsLOttMkceT7AAAAQI"]
[Thu May 07 19:11:09.623879 2026] [:error] [pid 15715:tid 15723] [client 85.203.23.193:34095] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/updates.php"] [unique_id "afxzTSY4dZsLOttMkceT7gAAAQY"]
[Thu May 07 19:11:09.821590 2026] [:error] [pid 15715:tid 15730] [client 85.203.23.221:48011] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/speculative8.php"] [unique_id "afxzTSY4dZsLOttMkceT8AAAAQo"]
[Thu May 07 19:11:10.019495 2026] [:error] [pid 15715:tid 15733] [client 85.203.23.189:41543] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/classwithtostring.php"] [unique_id "afxzTiY4dZsLOttMkceT8gAAAQ0"]
[Thu May 07 19:11:10.208631 2026] [:error] [pid 15715:tid 15721] [client 85.203.23.178:53397] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/PHPMailer/s"] [unique_id "afxzTiY4dZsLOttMkceT9AAAAQQ"]
[Thu May 07 19:11:10.405991 2026] [:error] [pid 15715:tid 15736] [client 85.203.23.225:37803] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "afxzTiY4dZsLOttMkceT9gAAARA"]
[Thu May 07 19:11:10.610008 2026] [:error] [pid 15715:tid 15743] [client 85.203.23.173:39087] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/"] [unique_id "afxzTiY4dZsLOttMkceT9wAAARc"]
[Thu May 07 19:11:10.817451 2026] [:error] [pid 15715:tid 15719] [client 85.203.23.211:20917] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/shell/"] [unique_id "afxzTiY4dZsLOttMkceT-AAAAQI"]
[Thu May 07 19:11:11.008090 2026] [:error] [pid 15715:tid 15739] [client 85.203.23.205:54403] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "afxzTyY4dZsLOttMkceT-QAAARM"]
[Thu May 07 19:11:11.220703 2026] [:error] [pid 15715:tid 15742] [client 85.203.23.218:25595] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/mah.php"] [unique_id "afxzTyY4dZsLOttMkceT-wAAARY"]
[Thu May 07 19:11:11.419028 2026] [:error] [pid 15715:tid 15725] [client 85.203.23.208:62151] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/file.php"] [unique_id "afxzTyY4dZsLOttMkceT_AAAAQg"]
[Thu May 07 19:11:11.608038 2026] [:error] [pid 15715:tid 15722] [client 85.203.23.220:46547] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/news-portal/sitebar.php"] [unique_id "afxzTyY4dZsLOttMkceT_QAAAQU"]
[Thu May 07 19:11:11.802119 2026] [:error] [pid 15715:tid 15733] [client 85.203.23.222:30491] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp.php"] [unique_id "afxzTyY4dZsLOttMkceT_gAAAQ0"]
[Thu May 07 19:11:12.044883 2026] [:error] [pid 28098:tid 28105] [client 85.203.23.215:37555] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/"] [unique_id "afxzUMvhwfljlt8trSrbwQAAAEU"]
[Thu May 07 19:11:12.232964 2026] [:error] [pid 28098:tid 28102] [client 85.203.23.199:27607] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/x.php"] [unique_id "afxzUMvhwfljlt8trSrbwwAAAEI"]
[Thu May 07 19:11:12.422736 2026] [:error] [pid 28098:tid 28114] [client 85.203.23.201:47317] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/modern/"] [unique_id "afxzUMvhwfljlt8trSrbxQAAAE4"]
[Thu May 07 19:11:12.615970 2026] [:error] [pid 28098:tid 28110] [client 85.203.23.181:64441] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/plugins/"] [unique_id "afxzUMvhwfljlt8trSrbxgAAAEo"]
[Thu May 07 19:11:12.813440 2026] [:error] [pid 28098:tid 28103] [client 85.203.23.166:48143] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/"] [unique_id "afxzUMvhwfljlt8trSrbyAAAAEM"]
[Thu May 07 19:11:18.007029 2026] [:error] [pid 15715:tid 15718] [client 85.203.23.218:65013] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "afxzViY4dZsLOttMkceUCwAAAQE"]
[Thu May 07 19:11:18.205803 2026] [:error] [pid 15715:tid 15741] [client 85.203.23.215:63383] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/system_core.php"] [unique_id "afxzViY4dZsLOttMkceUDQAAARU"]
[Thu May 07 19:11:18.426611 2026] [:error] [pid 15631:tid 15695] [client 85.203.23.178:42967] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/222.php"] [unique_id "afxzVnvP1GkPUuuLfqUz8QAAAMg"]
[Thu May 07 19:11:18.612859 2026] [:error] [pid 28098:tid 28100] [client 85.203.23.215:25029] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/"] [unique_id "afxzVsvhwfljlt8trSrb0AAAAEA"]
[Thu May 07 19:11:18.809824 2026] [:error] [pid 28098:tid 28115] [client 85.203.23.187:54017] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/"] [unique_id "afxzVsvhwfljlt8trSrb0QAAAE8"]
[Thu May 07 19:11:24.012279 2026] [:error] [pid 28098:tid 28109] [client 85.203.23.221:56795] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin.php"] [unique_id "afxzXMvhwfljlt8trSrb1wAAAEk"]
[Thu May 07 19:11:24.212300 2026] [:error] [pid 15630:tid 15684] [client 85.203.23.211:21439] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/"] [unique_id "afxzXHTithRAi4821qutBwAAAJg"]
[Thu May 07 19:11:24.402207 2026] [:error] [pid 15630:tid 15675] [client 85.203.23.192:22437] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/components/"] [unique_id "afxzXHTithRAi4821qutCAAAAI8"]
[Thu May 07 19:11:24.605017 2026] [:error] [pid 15630:tid 15661] [client 85.203.23.172:42565] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/images/"] [unique_id "afxzXHTithRAi4821qutCQAAAIE"]
[Thu May 07 19:11:24.808867 2026] [:error] [pid 15630:tid 15683] [client 85.203.23.191:42271] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/radio.php"] [unique_id "afxzXHTithRAi4821qutCgAAAJc"]
[Thu May 07 19:11:25.011704 2026] [:error] [pid 15630:tid 15665] [client 85.203.23.211:28461] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/archives/"] [unique_id "afxzXXTithRAi4821qutCwAAAIU"]
[Thu May 07 19:11:25.210159 2026] [:error] [pid 15630:tid 15682] [client 85.203.23.221:52389] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/images/admin.php"] [unique_id "afxzXXTithRAi4821qutDQAAAJY"]
[Thu May 07 19:11:25.405665 2026] [:error] [pid 15630:tid 15660] [client 85.203.23.177:55919] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/php-compat/"] [unique_id "afxzXXTithRAi4821qutDgAAAIA"]
[Thu May 07 19:11:25.837236 2026] [:error] [pid 15630:tid 15667] [client 85.203.23.203:41407] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/"] [unique_id "afxzXXTithRAi4821qutDwAAAIc"]
[Thu May 07 19:11:26.017621 2026] [:error] [pid 15630:tid 15681] [client 85.203.23.212:65339] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/blue/"] [unique_id "afxzXnTithRAi4821qutEAAAAJU"]
[Thu May 07 19:11:31.223669 2026] [:error] [pid 28098:tid 28119] [client 85.203.23.186:39917] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "afxzY8vhwfljlt8trSrb4gAAAFM"]
[Thu May 07 19:11:36.412416 2026] [:error] [pid 28098:tid 28122] [client 85.203.23.171:36221] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/info.php"] [unique_id "afxzaMvhwfljlt8trSrb6wAAAFY"]
[Thu May 07 19:11:36.609072 2026] [:error] [pid 28098:tid 28103] [client 85.203.23.221:38521] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-file.php"] [unique_id "afxzaMvhwfljlt8trSrb7QAAAEM"]
[Thu May 07 19:11:36.945661 2026] [:error] [pid 15715:tid 15722] [client 85.203.23.193:39609] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/upgrade/"] [unique_id "afxzaCY4dZsLOttMkceUJQAAAQU"]
[Thu May 07 19:11:37.231646 2026] [:error] [pid 15715:tid 15717] [client 85.203.23.187:42969] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/index/function.php"] [unique_id "afxzaSY4dZsLOttMkceUJwAAAQA"]
[Thu May 07 19:11:37.425046 2026] [:error] [pid 28098:tid 28119] [client 85.203.23.217:59293] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/light/"] [unique_id "afxzacvhwfljlt8trSrb7wAAAFM"]
[Thu May 07 19:11:37.620716 2026] [:error] [pid 15629:tid 15638] [client 85.203.23.192:24045] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/about.php"] [unique_id "afxzafrIJCALdUrO43l0DAAAAAU"]
[Thu May 07 19:11:37.802701 2026] [:error] [pid 28098:tid 28120] [client 85.203.23.225:24713] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/plugin/"] [unique_id "afxzacvhwfljlt8trSrb8AAAAFQ"]
[Thu May 07 19:11:38.022114 2026] [:error] [pid 15630:tid 15663] [client 85.203.23.216:25213] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/chosen.php"] [unique_id "afxzanTithRAi4821qutEgAAAIM"]
[Thu May 07 19:11:38.206672 2026] [:error] [pid 15630:tid 15680] [client 85.203.23.199:37541] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/"] [unique_id "afxzanTithRAi4821qutEwAAAJQ"]
[Thu May 07 19:11:38.411453 2026] [:error] [pid 15629:tid 15652] [client 85.203.23.177:51457] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-good.php"] [unique_id "afxzavrIJCALdUrO43l0DwAAABM"]
[Thu May 07 19:11:38.621140 2026] [:error] [pid 28098:tid 28101] [client 85.203.23.212:36969] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "afxzasvhwfljlt8trSrb8QAAAEE"]
[Thu May 07 19:11:38.822060 2026] [:error] [pid 15629:tid 15646] [client 85.203.23.223:27463] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403x.php"] [unique_id "afxzavrIJCALdUrO43l0EAAAAA0"]
[Thu May 07 19:11:44.007686 2026] [:error] [pid 15630:tid 15660] [client 85.203.23.199:35141] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/"] [unique_id "afxzcHTithRAi4821qutGgAAAIA"]
[Thu May 07 19:11:44.205400 2026] [:error] [pid 15629:tid 15653] [client 85.203.23.209:47375] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/"] [unique_id "afxzcPrIJCALdUrO43l0EgAAABQ"]
[Thu May 07 19:11:49.405915 2026] [:error] [pid 28098:tid 28120] [client 85.203.23.166:48569] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/header.php"] [unique_id "afxzdcvhwfljlt8trSrb_QAAAFQ"]
[Thu May 07 19:11:54.613415 2026] [:error] [pid 28098:tid 28118] [client 85.203.23.200:65207] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/pullquote/"] [unique_id "afxzesvhwfljlt8trSrcBQAAAFI"]
[Thu May 07 19:11:54.801425 2026] [:error] [pid 28098:tid 28112] [client 85.203.23.225:55557] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/2024/"] [unique_id "afxzesvhwfljlt8trSrcBgAAAEw"]
[Thu May 07 19:11:55.022412 2026] [:error] [pid 28098:tid 28110] [client 85.203.23.224:61397] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/src/Core/"] [unique_id "afxze8vhwfljlt8trSrcCAAAAEo"]
[Thu May 07 19:12:00.223219 2026] [:error] [pid 28098:tid 28110] [client 85.203.23.172:20581] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/.well-known/"] [unique_id "afxzgMvhwfljlt8trSrcEwAAAEo"]
[Thu May 07 19:12:00.622587 2026] [:error] [pid 15715:tid 15722] [client 85.203.23.220:53553] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/filester/assets/css/404.php"] [unique_id "afxzgCY4dZsLOttMkceUMQAAAQU"]
[Thu May 07 19:12:01.020536 2026] [:error] [pid 15631:tid 15692] [client 85.203.23.224:49165] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/ws.php"] [unique_id "afxzgXvP1GkPUuuLfqU0HAAAAMU"]
[Thu May 07 19:12:06.213530 2026] [:error] [pid 28098:tid 28115] [client 85.203.23.203:56577] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/"] [unique_id "afxzhsvhwfljlt8trSrcFwAAAE8"]
[Thu May 07 19:12:06.407514 2026] [:error] [pid 15631:tid 15695] [client 85.203.23.223:22849] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "afxzhnvP1GkPUuuLfqU0IQAAAMg"]
[Thu May 07 19:12:06.614417 2026] [:error] [pid 15630:tid 15677] [client 85.203.23.172:34365] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/edit-post/"] [unique_id "afxzhnTithRAi4821qutLQAAAJE"]
[Thu May 07 19:12:06.814317 2026] [:error] [pid 15715:tid 15732] [client 85.203.23.196:39015] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/"] [unique_id "afxzhiY4dZsLOttMkceUOgAAAQw"]
[Thu May 07 19:12:07.009170 2026] [:error] [pid 15630:tid 15683] [client 85.203.23.173:53117] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "afxzh3TithRAi4821qutLgAAAJc"]
[Thu May 07 19:12:07.221255 2026] [:error] [pid 15629:tid 15641] [client 85.203.23.172:42847] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/themes.php"] [unique_id "afxzh_rIJCALdUrO43l0GgAAAAg"]
[Thu May 07 19:12:07.412379 2026] [:error] [pid 15715:tid 15731] [client 85.203.23.187:54853] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "afxzhyY4dZsLOttMkceUOwAAAQs"]
[Thu May 07 19:12:07.610787 2026] [:error] [pid 15715:tid 15742] [client 85.203.23.192:22089] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/buy.php"] [unique_id "afxzhyY4dZsLOttMkceUPAAAARY"]
[Thu May 07 19:12:07.823715 2026] [:error] [pid 28098:tid 28121] [client 85.203.23.186:46703] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/includes/"] [unique_id "afxzh8vhwfljlt8trSrcHAAAAFU"]
[Thu May 07 19:12:08.019271 2026] [:error] [pid 15715:tid 15724] [client 85.203.23.185:45051] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wa/"] [unique_id "afxziCY4dZsLOttMkceUPQAAAQc"]
[Thu May 07 19:12:08.218292 2026] [:error] [pid 15630:tid 15662] [client 85.203.23.187:48625] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/"] [unique_id "afxziHTithRAi4821qutLwAAAII"]
[Thu May 07 19:12:13.421081 2026] [:error] [pid 15715:tid 15726] [client 85.203.23.217:56259] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/ahax.php"] [unique_id "afxzjSY4dZsLOttMkceURAAAAQk"]
[Thu May 07 19:12:18.611191 2026] [:error] [pid 15631:tid 15700] [client 85.203.23.180:54973] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/comment-date/"] [unique_id "afxzknvP1GkPUuuLfqU0KQAAAM0"]
[Thu May 07 19:12:18.802571 2026] [:error] [pid 15631:tid 15687] [client 85.203.23.221:41523] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/admin.php"] [unique_id "afxzknvP1GkPUuuLfqU0LAAAAMA"]
[Thu May 07 19:12:24.016927 2026] [:error] [pid 15631:tid 15701] [client 85.203.23.224:35797] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/fields/"] [unique_id "afxzmHvP1GkPUuuLfqU0PgAAAM4"]
[Thu May 07 19:12:24.210065 2026] [:error] [pid 15631:tid 15710] [client 85.203.23.203:26931] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/log.php"] [unique_id "afxzmHvP1GkPUuuLfqU0PwAAANc"]
[Thu May 07 19:12:24.418036 2026] [:error] [pid 15631:tid 15692] [client 85.203.23.173:38743] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/themes/about.php"] [unique_id "afxzmHvP1GkPUuuLfqU0QAAAAMU"]
[Thu May 07 19:12:24.603675 2026] [:error] [pid 15630:tid 15664] [client 85.203.23.210:38603] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-conflg.php"] [unique_id "afxzmHTithRAi4821qutOgAAAIQ"]
[Thu May 07 19:12:29.804022 2026] [:error] [pid 15629:tid 15648] [client 85.203.23.196:61897] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "afxznfrIJCALdUrO43l0IgAAAA8"]
[Thu May 07 19:12:35.020712 2026] [:error] [pid 15630:tid 15673] [client 85.203.23.184:38823] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/panel.php"] [unique_id "afxzo3TithRAi4821qutQAAAAI0"]
[Thu May 07 19:12:35.217699 2026] [:error] [pid 15629:tid 15657] [client 85.203.23.200:53107] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/"] [unique_id "afxzo_rIJCALdUrO43l0JgAAABg"]
[Thu May 07 19:12:40.431401 2026] [:error] [pid 28098:tid 28115] [client 85.203.23.220:45043] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/development/"] [unique_id "afxzqMvhwfljlt8trSrcQAAAAE8"]
[Thu May 07 19:12:40.628792 2026] [:error] [pid 28098:tid 28106] [client 85.203.23.218:34653] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/network/"] [unique_id "afxzqMvhwfljlt8trSrcQwAAAEY"]
[Thu May 07 19:12:40.838163 2026] [:error] [pid 15629:tid 15649] [client 85.203.23.216:21717] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/m.php"] [unique_id "afxzqPrIJCALdUrO43l0MAAAABA"]
[Thu May 07 19:12:41.032336 2026] [:error] [pid 28098:tid 28102] [client 85.203.23.196:55303] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/admin/function.php"] [unique_id "afxzqcvhwfljlt8trSrcRwAAAEI"]
[Thu May 07 19:12:41.216377 2026] [:error] [pid 15715:tid 15737] [client 85.203.23.184:21845] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/code/"] [unique_id "afxzqSY4dZsLOttMkceUXAAAARE"]
[Thu May 07 19:12:41.434634 2026] [:error] [pid 28098:tid 28114] [client 85.203.23.195:65093] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "afxzqcvhwfljlt8trSrcSAAAAE4"]
[Thu May 07 19:12:46.617496 2026] [:error] [pid 15630:tid 15678] [client 85.203.23.209:56049] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/a.php"] [unique_id "afxzrnTithRAi4821qutUAAAAJI"]
[Thu May 07 19:12:46.840726 2026] [:error] [pid 15629:tid 15645] [client 85.203.23.201:45447] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/includes/"] [unique_id "afxzrvrIJCALdUrO43l0NgAAAAw"]
[Thu May 07 19:12:47.028266 2026] [:error] [pid 15630:tid 15661] [client 85.203.23.188:36121] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/themes/"] [unique_id "afxzr3TithRAi4821qutUQAAAIE"]
[Thu May 07 19:12:47.226389 2026] [:error] [pid 28098:tid 28100] [client 85.203.23.173:39583] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/footnotes/"] [unique_id "afxzr8vhwfljlt8trSrcTgAAAEA"]
[Thu May 07 19:12:52.416681 2026] [:error] [pid 15630:tid 15664] [client 85.203.23.196:35351] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/theme-check/main.php"] [unique_id "afxztHTithRAi4821qutXAAAAIQ"]
[Thu May 07 19:12:52.620678 2026] [:error] [pid 15630:tid 15667] [client 85.203.23.208:29625] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/lib/"] [unique_id "afxztHTithRAi4821qutXQAAAIc"]
[Thu May 07 19:12:52.817085 2026] [:error] [pid 15629:tid 15633] [client 85.203.23.222:22069] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/upload.php"] [unique_id "afxztPrIJCALdUrO43l0OgAAAAA"]
[Thu May 07 19:13:03.033924 2026] [:error] [pid 28098:tid 28104] [client 85.203.23.189:55321] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/rip.php"] [unique_id "afxzv8vhwfljlt8trSrcZAAAAEQ"]
[Thu May 07 19:13:03.220056 2026] [:error] [pid 28098:tid 28109] [client 85.203.23.208:64463] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/fukasawa/inc/classes/403x.php"] [unique_id "afxzv8vhwfljlt8trSrcZQAAAEk"]
[Thu May 07 19:13:08.419663 2026] [:error] [pid 28098:tid 28109] [client 85.203.23.209:44585] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/config.php"] [unique_id "afxzxMvhwfljlt8trSrcdAAAAEk"]
[Thu May 07 19:13:08.622395 2026] [:error] [pid 28098:tid 28106] [client 85.203.23.218:64855] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/src/Content/Type/"] [unique_id "afxzxMvhwfljlt8trSrcdQAAAEY"]
[Thu May 07 19:13:08.817593 2026] [:error] [pid 28098:tid 28110] [client 85.203.23.222:33701] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/css.php"] [unique_id "afxzxMvhwfljlt8trSrcdgAAAEo"]
[Thu May 07 19:13:09.003371 2026] [:error] [pid 28098:tid 28123] [client 85.203.23.199:65033] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/freeform/"] [unique_id "afxzxcvhwfljlt8trSrcdwAAAFc"]
[Thu May 07 19:13:09.203684 2026] [:error] [pid 15631:tid 15688] [client 85.203.23.169:34659] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/post-comments-form/"] [unique_id "afxzxXvP1GkPUuuLfqU0WQAAAME"]
[Thu May 07 19:13:09.414630 2026] [:error] [pid 15631:tid 15687] [client 85.203.23.192:62429] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/system_log.php"] [unique_id "afxzxXvP1GkPUuuLfqU0WgAAAMA"]
[Thu May 07 19:13:09.612960 2026] [:error] [pid 15715:tid 15734] [client 85.203.23.209:20807] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/neve/assets/apps/dashboard/build/"] [unique_id "afxzxSY4dZsLOttMkceUXgAAAQ4"]
[Thu May 07 19:13:14.817403 2026] [:error] [pid 15631:tid 15702] [client 85.203.23.185:26547] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afxzynvP1GkPUuuLfqU0XgAAAM8"]
[Thu May 07 19:13:15.017164 2026] [:error] [pid 28098:tid 28121] [client 85.203.23.169:33859] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/ocean/"] [unique_id "afxzy8vhwfljlt8trSrcfwAAAFU"]
[Thu May 07 19:13:15.213120 2026] [:error] [pid 15630:tid 15663] [client 85.203.23.200:43105] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/"] [unique_id "afxzy3TithRAi4821qutawAAAIM"]
[Thu May 07 19:13:20.421024 2026] [:error] [pid 15715:tid 15743] [client 85.203.23.203:46437] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/"] [unique_id "afxz0CY4dZsLOttMkceUXwAAARc"]
[Thu May 07 19:13:20.607548 2026] [:error] [pid 15631:tid 15690] [client 85.203.23.221:64449] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/worksec.php"] [unique_id "afxz0HvP1GkPUuuLfqU0ZQAAAMM"]
[Thu May 07 19:13:20.816295 2026] [:error] [pid 15631:tid 15688] [client 85.203.23.218:23137] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/packed.php"] [unique_id "afxz0HvP1GkPUuuLfqU0ZgAAAME"]
[Thu May 07 19:13:21.009554 2026] [:error] [pid 15715:tid 15718] [client 85.203.23.192:21265] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/network/cache/"] [unique_id "afxz0SY4dZsLOttMkceUYQAAAQE"]
[Thu May 07 19:13:21.201281 2026] [:error] [pid 15715:tid 15739] [client 85.203.23.195:29471] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfour/patterns/file.php"] [unique_id "afxz0SY4dZsLOttMkceUYwAAARM"]
[Thu May 07 19:13:21.415248 2026] [:error] [pid 15631:tid 15695] [client 85.203.23.199:64305] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin-header.php"] [unique_id "afxz0XvP1GkPUuuLfqU0ZwAAAMg"]
[Thu May 07 19:13:21.610577 2026] [:error] [pid 15631:tid 15704] [client 85.203.23.209:38821] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/details/"] [unique_id "afxz0XvP1GkPUuuLfqU0aAAAANE"]
[Thu May 07 19:13:21.829589 2026] [:error] [pid 15631:tid 15691] [client 85.203.23.169:22565] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/endpoints/"] [unique_id "afxz0XvP1GkPUuuLfqU0aQAAAMQ"]
[Thu May 07 19:13:22.033510 2026] [:error] [pid 28098:tid 28112] [client 85.203.23.201:33767] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/"] [unique_id "afxz0svhwfljlt8trSrcgwAAAEw"]
[Thu May 07 19:13:27.229511 2026] [:error] [pid 28098:tid 28114] [client 85.203.23.224:49849] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wp-conflg.php"] [unique_id "afxz18vhwfljlt8trSrchgAAAE4"]
[Thu May 07 19:13:27.430023 2026] [:error] [pid 15631:tid 15691] [client 85.203.23.215:38031] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/config.php"] [unique_id "afxz13vP1GkPUuuLfqU0dgAAAMQ"]
[Thu May 07 19:13:27.627521 2026] [:error] [pid 15631:tid 15694] [client 85.203.23.220:50301] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/chosen.php"] [unique_id "afxz13vP1GkPUuuLfqU0dwAAAMc"]
[Thu May 07 19:13:29.313710 2026] [:error] [pid 15715:tid 15725] [client 85.203.23.222:41371] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "afxz2SY4dZsLOttMkceUeQAAAQg"]
[Thu May 07 19:13:29.512858 2026] [:error] [pid 15715:tid 15718] [client 85.203.23.211:62987] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/images/"] [unique_id "afxz2SY4dZsLOttMkceUewAAAQE"]
[Thu May 07 19:13:29.708368 2026] [:error] [pid 15715:tid 15743] [client 85.203.23.218:27131] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/vendor/about.php"] [unique_id "afxz2SY4dZsLOttMkceUfAAAARc"]
[Thu May 07 19:13:29.929311 2026] [:error] [pid 15630:tid 15684] [client 85.203.23.188:31105] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfour/"] [unique_id "afxz2XTithRAi4821quteQAAAJg"]
[Thu May 07 19:13:30.137467 2026] [:error] [pid 15715:tid 15721] [client 85.203.23.215:61667] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/maint/"] [unique_id "afxz2iY4dZsLOttMkceUfgAAAQQ"]
[Thu May 07 19:13:30.321444 2026] [:error] [pid 15715:tid 15742] [client 85.203.23.217:24305] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/"] [unique_id "afxz2iY4dZsLOttMkceUfwAAARY"]
[Thu May 07 19:13:35.513515 2026] [:error] [pid 28098:tid 28106] [client 85.203.23.184:50689] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/separator/"] [unique_id "afxz38vhwfljlt8trSrcjAAAAEY"]
[Thu May 07 19:13:40.733587 2026] [:error] [pid 15630:tid 15669] [client 85.203.23.218:43911] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/buttons/"] [unique_id "afxz5HTithRAi4821qutfQAAAIk"]
[Thu May 07 19:13:40.918408 2026] [:error] [pid 15630:tid 15677] [client 85.203.23.199:22433] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content.php"] [unique_id "afxz5HTithRAi4821qutfgAAAJE"]
[Thu May 07 19:13:41.110142 2026] [:error] [pid 15630:tid 15664] [client 85.203.23.199:28811] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "afxz5XTithRAi4821qutgAAAAIQ"]
[Thu May 07 19:13:41.320397 2026] [:error] [pid 15631:tid 15711] [client 85.203.23.202:57669] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/.well-known/acme-challenge/"] [unique_id "afxz5XvP1GkPUuuLfqU0fAAAANg"]
[Thu May 07 19:13:41.508037 2026] [:error] [pid 28098:tid 28113] [client 85.203.23.210:36609] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/shell.php"] [unique_id "afxz5cvhwfljlt8trSrckwAAAE0"]
[Thu May 07 19:13:41.727349 2026] [:error] [pid 28098:tid 28116] [client 85.203.23.205:52035] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/image/"] [unique_id "afxz5cvhwfljlt8trSrclQAAAFA"]
[Thu May 07 19:13:42.002758 2026] [:error] [pid 28098:tid 28121] [client 85.203.23.218:33703] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/files.php"] [unique_id "afxz5svhwfljlt8trSrcmAAAAFU"]
[Thu May 07 19:13:42.218514 2026] [:error] [pid 15631:tid 15704] [client 85.203.23.217:51747] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/video/"] [unique_id "afxz5nvP1GkPUuuLfqU0fgAAANE"]
[Thu May 07 19:13:42.406920 2026] [:error] [pid 15631:tid 15691] [client 85.203.23.218:40915] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfive/"] [unique_id "afxz5nvP1GkPUuuLfqU0fwAAAMQ"]
[Thu May 07 19:13:47.617245 2026] [:error] [pid 15630:tid 15684] [client 85.203.23.185:23585] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-activate.php"] [unique_id "afxz63TithRAi4821quthwAAAJg"]
[Thu May 07 19:13:48.118866 2026] [:error] [pid 15630:tid 15678] [client 85.203.23.225:60127] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/chosen.php"] [unique_id "afxz7HTithRAi4821qutigAAAJI"]
[Thu May 07 19:13:48.413084 2026] [:error] [pid 15715:tid 15732] [client 85.203.23.186:64435] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/backup.php"] [unique_id "afxz7CY4dZsLOttMkceUkwAAAQw"]
[Thu May 07 19:13:53.621530 2026] [:error] [pid 28098:tid 28106] [client 85.203.23.166:27107] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/login.php"] [unique_id "afxz8cvhwfljlt8trSrcpgAAAEY"]
[Thu May 07 19:13:53.805644 2026] [:error] [pid 28098:tid 28110] [client 85.203.23.177:34985] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfour/assets/"] [unique_id "afxz8cvhwfljlt8trSrcqAAAAEo"]
[Thu May 07 19:13:54.006425 2026] [:error] [pid 28098:tid 28112] [client 85.203.23.218:62847] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/ab.php"] [unique_id "afxz8svhwfljlt8trSrcqgAAAEw"]
[Thu May 07 19:13:54.220055 2026] [:error] [pid 28098:tid 28113] [client 85.203.23.212:36191] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/login.php"] [unique_id "afxz8svhwfljlt8trSrcrAAAAE0"]
[Thu May 07 19:13:54.448676 2026] [:error] [pid 28098:tid 28119] [client 85.203.23.181:27757] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Auth/"] [unique_id "afxz8svhwfljlt8trSrcrwAAAFM"]
[Thu May 07 19:13:59.634882 2026] [:error] [pid 15630:tid 15684] [client 85.203.23.202:48381] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/panel.php"] [unique_id "afxz93TithRAi4821qutlQAAAJg"]
[Thu May 07 19:13:59.823025 2026] [:error] [pid 28098:tid 28106] [client 85.203.23.184:43907] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/commands/"] [unique_id "afxz98vhwfljlt8trSrcvQAAAEY"]
[Thu May 07 19:14:00.004175 2026] [:error] [pid 15630:tid 15674] [client 85.203.23.224:51591] [client 85.203.23.224] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/vx.php"] [unique_id "afxz-HTithRAi4821qutlwAAAI4"]
[Thu May 07 19:14:05.213789 2026] [:error] [pid 28098:tid 28123] [client 85.203.23.222:27039] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/about.php"] [unique_id "afxz_cvhwfljlt8trSrcyAAAAFc"]
[Thu May 07 19:14:05.404779 2026] [:error] [pid 28098:tid 28102] [client 85.203.23.211:34951] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jcrop/"] [unique_id "afxz_cvhwfljlt8trSrcyQAAAEI"]
[Thu May 07 19:14:10.634561 2026] [:error] [pid 15715:tid 15720] [client 85.203.23.208:33657] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/"] [unique_id "afx0AiY4dZsLOttMkceUpAAAAQM"]
[Thu May 07 19:14:16.011642 2026] [:error] [pid 15631:tid 15702] [client 85.203.23.192:65479] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-signin.php"] [unique_id "afx0CHvP1GkPUuuLfqU0jwAAAM8"]
[Thu May 07 19:14:16.205204 2026] [:error] [pid 28098:tid 28113] [client 85.203.23.217:46841] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentynineteen/sass/site/"] [unique_id "afx0CMvhwfljlt8trSrc6gAAAE0"]
[Thu May 07 19:14:16.410261 2026] [:error] [pid 15631:tid 15703] [client 85.203.23.203:45433] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-config-backup.php"] [unique_id "afx0CHvP1GkPUuuLfqU0kAAAANA"]
[Thu May 07 19:14:16.603766 2026] [:error] [pid 15631:tid 15709] [client 85.203.23.195:49761] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/coffee/"] [unique_id "afx0CHvP1GkPUuuLfqU0kQAAANY"]
[Thu May 07 19:14:16.806114 2026] [:error] [pid 15631:tid 15692] [client 85.203.23.215:63547] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "afx0CHvP1GkPUuuLfqU0kgAAAMU"]
[Thu May 07 19:14:17.020853 2026] [:error] [pid 28098:tid 28120] [client 85.203.23.220:34389] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/widgets/"] [unique_id "afx0Ccvhwfljlt8trSrc6wAAAFQ"]
[Thu May 07 19:14:22.205504 2026] [:error] [pid 28098:tid 28123] [client 85.203.23.201:41143] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/edit-wolf.php"] [unique_id "afx0Dsvhwfljlt8trSrc-AAAAFc"]
[Thu May 07 19:14:27.410031 2026] [:error] [pid 15631:tid 15709] [client 85.203.23.187:51079] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/system.php"] [unique_id "afx0E3vP1GkPUuuLfqU0nAAAANY"]
[Thu May 07 19:14:27.626338 2026] [:error] [pid 15630:tid 15674] [client 85.203.23.221:36877] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "afx0E3TithRAi4821qutoAAAAI4"]
[Thu May 07 19:14:27.817752 2026] [:error] [pid 15715:tid 15726] [client 85.203.23.202:23269] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/abcd.php"] [unique_id "afx0EyY4dZsLOttMkceUrgAAAQk"]
[Thu May 07 19:14:28.093878 2026] [:error] [pid 28098:tid 28115] [client 85.203.23.180:49287] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/adminfuns.php"] [unique_id "afx0FMvhwfljlt8trSrdAAAAAE8"]
[Thu May 07 19:14:28.508986 2026] [:error] [pid 15630:tid 15666] [client 85.203.23.172:46333] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/app.php"] [unique_id "afx0FHTithRAi4821qutowAAAIY"]
[Thu May 07 19:14:29.010420 2026] [:error] [pid 15629:tid 15641] [client 85.203.23.201:62463] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/files/"] [unique_id "afx0FfrIJCALdUrO43l0awAAAAg"]
[Thu May 07 19:14:29.211667 2026] [:error] [pid 15630:tid 15673] [client 85.203.23.186:24685] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/beteng83/ws78.php"] [unique_id "afx0FXTithRAi4821qutpQAAAI0"]
[Thu May 07 19:14:29.414940 2026] [:error] [pid 15630:tid 15676] [client 85.203.23.185:22919] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "afx0FXTithRAi4821qutpwAAAJA"]
[Thu May 07 19:14:29.620595 2026] [:error] [pid 15629:tid 15655] [client 85.203.23.185:28967] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/chosen.php"] [unique_id "afx0FfrIJCALdUrO43l0bAAAABY"]
[Thu May 07 19:14:29.807492 2026] [:error] [pid 15629:tid 15636] [client 85.203.23.193:53937] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/ALFA_DATA/alfacgiapi/"] [unique_id "afx0FfrIJCALdUrO43l0bgAAAAM"]
[Thu May 07 19:14:30.027841 2026] [:error] [pid 15630:tid 15661] [client 85.203.23.177:21143] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/comments-pagination-next/"] [unique_id "afx0FnTithRAi4821qutqgAAAIE"]
[Thu May 07 19:14:30.225185 2026] [:error] [pid 15630:tid 15684] [client 85.203.23.218:32775] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/images/html-api/"] [unique_id "afx0FnTithRAi4821qutqwAAAJg"]
[Thu May 07 19:14:30.448521 2026] [:error] [pid 15631:tid 15689] [client 85.203.23.201:30099] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/class.php"] [unique_id "afx0FnvP1GkPUuuLfqU0nwAAAMI"]
[Thu May 07 19:14:31.133337 2026] [:error] [pid 28098:tid 28102] [client 85.203.23.166:21273] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/network/colors/"] [unique_id "afx0F8vhwfljlt8trSrdBAAAAEI"]
[Thu May 07 19:14:31.416531 2026] [:error] [pid 28098:tid 28105] [client 85.203.23.166:33785] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/group/"] [unique_id "afx0F8vhwfljlt8trSrdBQAAAEU"]
[Thu May 07 19:14:31.609675 2026] [:error] [pid 15630:tid 15665] [client 85.203.23.211:47317] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "afx0F3TithRAi4821qutrQAAAIU"]
[Thu May 07 19:14:31.811455 2026] [:error] [pid 15631:tid 15699] [client 85.203.23.180:61561] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/module.php"] [unique_id "afx0F3vP1GkPUuuLfqU0owAAAMw"]
[Thu May 07 19:14:32.020417 2026] [:error] [pid 15631:tid 15696] [client 85.203.23.171:31831] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/user.php"] [unique_id "afx0GHvP1GkPUuuLfqU0pAAAAMk"]
[Thu May 07 19:14:32.207182 2026] [:error] [pid 15630:tid 15660] [client 85.203.23.196:52845] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/about.php"] [unique_id "afx0GHTithRAi4821qutrgAAAIA"]
[Thu May 07 19:14:32.423695 2026] [:error] [pid 28098:tid 28114] [client 85.203.23.188:53567] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/widget-group/"] [unique_id "afx0GMvhwfljlt8trSrdBgAAAE4"]
[Thu May 07 19:14:32.608368 2026] [:error] [pid 15629:tid 15651] [client 85.203.23.173:58285] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/config.php"] [unique_id "afx0GPrIJCALdUrO43l0cgAAABI"]
[Thu May 07 19:14:32.820311 2026] [:error] [pid 15631:tid 15703] [client 85.203.23.189:30003] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/2025/"] [unique_id "afx0GHvP1GkPUuuLfqU0pgAAANA"]
[Thu May 07 19:14:33.011677 2026] [:error] [pid 15715:tid 15725] [client 85.203.23.216:54705] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "afx0GSY4dZsLOttMkceUsAAAAQg"]
[Thu May 07 19:14:48.234905 2026] [:error] [pid 28098:tid 28121] [client 85.203.23.180:44111] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "afx0KMvhwfljlt8trSrdNgAAAFU"]
[Thu May 07 19:14:48.422140 2026] [:error] [pid 15715:tid 15738] [client 85.203.23.185:35343] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/"] [unique_id "afx0KCY4dZsLOttMkceVDAAAARI"]
[Thu May 07 19:14:48.605161 2026] [:error] [pid 28098:tid 28101] [client 85.203.23.205:51407] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/lock360.php"] [unique_id "afx0KMvhwfljlt8trSrdNwAAAEE"]
[Thu May 07 19:14:53.815032 2026] [:error] [pid 15631:tid 15698] [client 85.203.23.187:50583] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/we.php"] [unique_id "afx0LXvP1GkPUuuLfqU0ygAAAMs"]
[Thu May 07 19:14:59.006947 2026] [:error] [pid 28098:tid 28117] [client 85.203.23.220:42983] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/lock360.php"] [unique_id "afx0M8vhwfljlt8trSrdRQAAAFE"]
[Thu May 07 19:15:04.321374 2026] [:error] [pid 28098:tid 28102] [client 85.203.23.178:54779] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/navigation-submenu/"] [unique_id "afx0OMvhwfljlt8trSrdUAAAAEI"]
[Thu May 07 19:15:04.701629 2026] [:error] [pid 28098:tid 28107] [client 85.203.23.181:41905] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/file.php"] [unique_id "afx0OMvhwfljlt8trSrdUQAAAEc"]
[Thu May 07 19:15:04.910277 2026] [:error] [pid 15631:tid 15696] [client 85.203.23.188:37415] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/users.php"] [unique_id "afx0OHvP1GkPUuuLfqU00AAAAMk"]
[Thu May 07 19:15:05.107820 2026] [:error] [pid 15631:tid 15697] [client 85.203.23.218:33245] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/autoload_classmap.php"] [unique_id "afx0OXvP1GkPUuuLfqU00gAAAMo"]
[Thu May 07 19:15:05.304525 2026] [:error] [pid 28098:tid 28120] [client 85.203.23.205:40203] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/library/222.php"] [unique_id "afx0Ocvhwfljlt8trSrdUgAAAFQ"]
[Thu May 07 19:15:05.509090 2026] [:error] [pid 15715:tid 15719] [client 85.203.23.203:51313] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-update.php"] [unique_id "afx0OSY4dZsLOttMkceVFgAAAQI"]
[Thu May 07 19:15:05.729668 2026] [:error] [pid 28098:tid 28121] [client 85.203.23.192:59951] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/database.php"] [unique_id "afx0Ocvhwfljlt8trSrdUwAAAFU"]
[Thu May 07 19:15:05.936922 2026] [:error] [pid 15715:tid 15735] [client 85.203.23.177:23877] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/"] [unique_id "afx0OSY4dZsLOttMkceVFwAAAQ8"]
[Thu May 07 19:15:06.452734 2026] [:error] [pid 15715:tid 15723] [client 85.203.23.184:56083] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/chosen.php"] [unique_id "afx0OiY4dZsLOttMkceVGAAAAQY"]
[Thu May 07 19:15:06.848285 2026] [:error] [pid 15715:tid 15740] [client 85.203.23.170:39107] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/network/"] [unique_id "afx0OiY4dZsLOttMkceVGQAAARQ"]
[Thu May 07 19:15:17.035771 2026] [:error] [pid 15631:tid 15709] [client 85.203.23.197:57015] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/"] [unique_id "afx0RXvP1GkPUuuLfqU01gAAANY"]
[Thu May 07 19:15:17.221188 2026] [:error] [pid 15630:tid 15668] [client 85.203.23.222:55047] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/woocommerce/includes/import/about.php"] [unique_id "afx0RXTithRAi4821qut6QAAAIg"]
[Thu May 07 19:15:17.417252 2026] [:error] [pid 15715:tid 15721] [client 85.203.23.216:34353] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/paragraph/"] [unique_id "afx0RSY4dZsLOttMkceVGwAAAQQ"]
[Thu May 07 19:15:22.608456 2026] [:error] [pid 28098:tid 28110] [client 85.203.23.191:36553] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/crystal/"] [unique_id "afx0Ssvhwfljlt8trSrddQAAAEo"]
[Thu May 07 19:15:22.810970 2026] [:error] [pid 28098:tid 28123] [client 85.203.23.205:39293] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/mediaelement/"] [unique_id "afx0Ssvhwfljlt8trSrdeQAAAFc"]
[Thu May 07 19:15:28.035333 2026] [:error] [pid 15631:tid 15689] [client 85.203.23.170:51749] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/astra/assets/css/"] [unique_id "afx0UHvP1GkPUuuLfqU02gAAAMI"]
[Thu May 07 19:15:28.218316 2026] [:error] [pid 28098:tid 28114] [client 85.203.23.212:36461] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/222.php"] [unique_id "afx0UMvhwfljlt8trSrdgQAAAE4"]
[Thu May 07 19:15:28.406320 2026] [:error] [pid 15631:tid 15700] [client 85.203.23.172:41807] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/"] [unique_id "afx0UHvP1GkPUuuLfqU02wAAAM0"]
[Thu May 07 19:15:28.616853 2026] [:error] [pid 15631:tid 15704] [client 85.203.23.191:21755] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfour/patterns/template-singl-portfolio.php"] [unique_id "afx0UHvP1GkPUuuLfqU03AAAANE"]
[Thu May 07 19:15:28.808007 2026] [:error] [pid 15630:tid 15675] [client 85.203.23.217:64997] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/"] [unique_id "afx0UHTithRAi4821qut-QAAAI8"]
[Thu May 07 19:15:29.039108 2026] [:error] [pid 28098:tid 28104] [client 85.203.23.199:20649] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/widgets/wp-conflg.php"] [unique_id "afx0Ucvhwfljlt8trSrdgwAAAEQ"]
[Thu May 07 19:15:34.227457 2026] [:error] [pid 28098:tid 28102] [client 85.203.23.173:50621] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/pattern/"] [unique_id "afx0Vsvhwfljlt8trSrdjAAAAEI"]
[Thu May 07 19:15:34.409598 2026] [:error] [pid 15631:tid 15707] [client 85.203.23.177:36895] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-load.php"] [unique_id "afx0VnvP1GkPUuuLfqU03gAAANQ"]
[Thu May 07 19:15:34.614134 2026] [:error] [pid 15630:tid 15671] [client 85.203.23.208:58821] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/news-portal/user-install.php"] [unique_id "afx0VnTithRAi4821qut_wAAAIs"]
[Thu May 07 19:15:34.811688 2026] [:error] [pid 15630:tid 15679] [client 85.203.23.203:23193] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/table/"] [unique_id "afx0VnTithRAi4821quuAAAAAJM"]
[Thu May 07 19:15:35.020653 2026] [:error] [pid 15631:tid 15703] [client 85.203.23.203:41727] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/images/block-bindings/"] [unique_id "afx0V3vP1GkPUuuLfqU03wAAANA"]
[Thu May 07 19:15:35.207369 2026] [:error] [pid 15630:tid 15669] [client 85.203.23.192:25001] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-cache-sys/"] [unique_id "afx0V3TithRAi4821quuAQAAAIk"]
[Thu May 07 19:15:35.418404 2026] [:error] [pid 28098:tid 28119] [client 85.203.23.186:25243] [client 85.203.23.186] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist"] [unique_id "afx0V8vhwfljlt8trSrdkAAAAFM"]
[Thu May 07 19:15:40.619726 2026] [:error] [pid 28098:tid 28101] [client 85.203.23.220:43467] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh.php"] [unique_id "afx0XMvhwfljlt8trSrdmAAAAEE"]
[Thu May 07 19:15:40.810050 2026] [:error] [pid 15631:tid 15693] [client 85.203.23.216:60095] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/accordion/"] [unique_id "afx0XHvP1GkPUuuLfqU04wAAAMY"]
[Thu May 07 19:15:41.005260 2026] [:error] [pid 28098:tid 28119] [client 85.203.23.188:45187] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/Nxploited/class-payment.php"] [unique_id "afx0Xcvhwfljlt8trSrdnAAAAFM"]
[Thu May 07 19:15:41.211891 2026] [:error] [pid 28098:tid 28123] [client 85.203.23.211:46605] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/home.php"] [unique_id "afx0Xcvhwfljlt8trSrdngAAAFc"]
[Thu May 07 19:15:41.413218 2026] [:error] [pid 28098:tid 28114] [client 85.203.23.203:51449] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/fonts/"] [unique_id "afx0Xcvhwfljlt8trSrdoAAAAE4"]
[Thu May 07 19:15:46.634868 2026] [:error] [pid 28098:tid 28100] [client 85.203.23.211:52675] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/dist/script-modules/block-library/file/"] [unique_id "afx0Ysvhwfljlt8trSrdqwAAAEA"]
[Thu May 07 19:15:46.822523 2026] [:error] [pid 15715:tid 15741] [client 85.203.23.200:43167] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-theme-json-resolver-sql.php"] [unique_id "afx0YiY4dZsLOttMkceVIgAAARU"]
[Thu May 07 19:15:47.005950 2026] [:error] [pid 28098:tid 28123] [client 85.203.23.187:58601] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/classwithtostring.php"] [unique_id "afx0Y8vhwfljlt8trSrdrAAAAFc"]
[Thu May 07 19:15:47.201560 2026] [:error] [pid 28098:tid 28111] [client 85.203.23.181:53811] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/widgets/"] [unique_id "afx0Y8vhwfljlt8trSrdrgAAAEs"]
[Thu May 07 19:15:57.415518 2026] [:error] [pid 15629:tid 15642] [client 85.203.23.178:24943] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/"] [unique_id "afx0bfrIJCALdUrO43l0kwAAAAk"]
[Thu May 07 19:15:57.600726 2026] [:error] [pid 15631:tid 15690] [client 85.203.23.199:33625] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyone/assets/"] [unique_id "afx0bXvP1GkPUuuLfqU06AAAAMM"]
[Thu May 07 19:15:57.811507 2026] [:error] [pid 15630:tid 15678] [client 85.203.23.215:26513] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/aboutc.php"] [unique_id "afx0bXTithRAi4821quuDwAAAJI"]
[Thu May 07 19:15:58.003682 2026] [:error] [pid 15630:tid 15675] [client 85.203.23.189:43107] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/chosen.php"] [unique_id "afx0bnTithRAi4821quuEAAAAI8"]
[Thu May 07 19:15:58.203231 2026] [:error] [pid 15631:tid 15688] [client 85.203.23.181:38911] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/Content/Type/Sniffer.plugin.php"] [unique_id "afx0bnvP1GkPUuuLfqU06QAAAME"]
[Thu May 07 19:15:58.411733 2026] [:error] [pid 15629:tid 15637] [client 85.203.23.201:21633] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/"] [unique_id "afx0bvrIJCALdUrO43l0lAAAAAQ"]
[Thu May 07 19:15:58.607849 2026] [:error] [pid 15630:tid 15666] [client 85.203.23.193:47887] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/cgi-bin/cgi-bin/config.php"] [unique_id "afx0bnTithRAi4821quuEQAAAIY"]
[Thu May 07 19:16:03.807118 2026] [:error] [pid 28098:tid 28117] [client 85.203.23.217:47425] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/system.php"] [unique_id "afx0c8vhwfljlt8trSrdvAAAAFE"]
[Thu May 07 19:16:04.004670 2026] [:error] [pid 28098:tid 28122] [client 85.203.23.187:24363] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/login.php"] [unique_id "afx0dMvhwfljlt8trSrdvgAAAFY"]
[Thu May 07 19:16:04.201880 2026] [:error] [pid 15631:tid 15699] [client 85.203.23.187:50673] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sc_1.php"] [unique_id "afx0dHvP1GkPUuuLfqU07QAAAMw"]
[Thu May 07 19:16:04.415296 2026] [:error] [pid 28098:tid 28124] [client 85.203.23.221:25457] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/gk.php"] [unique_id "afx0dMvhwfljlt8trSrdwAAAAFg"]
[Thu May 07 19:16:04.612112 2026] [:error] [pid 15631:tid 15705] [client 85.203.23.166:42603] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/about/system_core.php"] [unique_id "afx0dHvP1GkPUuuLfqU07wAAANI"]
[Thu May 07 19:16:09.817440 2026] [:error] [pid 15630:tid 15666] [client 85.203.23.201:23711] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/ALFA_DATA/alfacgiapi/system_core.php"] [unique_id "afx0eXTithRAi4821quuGwAAAIY"]
[Thu May 07 19:16:09.999582 2026] [:error] [pid 28098:tid 28115] [client 85.203.23.197:43861] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/contact/system_core.php"] [unique_id "afx0ecvhwfljlt8trSrdzAAAAE8"]
[Thu May 07 19:16:10.207232 2026] [:error] [pid 28098:tid 28123] [client 85.203.23.225:55079] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/ai-builder/system_core.php"] [unique_id "afx0esvhwfljlt8trSrdzQAAAFc"]
[Thu May 07 19:16:10.412818 2026] [:error] [pid 15629:tid 15654] [client 85.203.23.208:62157] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/ast-block-templates-json/system_core.php"] [unique_id "afx0evrIJCALdUrO43l0nwAAABU"]
[Thu May 07 19:16:10.599899 2026] [:error] [pid 15629:tid 15656] [client 85.203.23.187:22379] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/astra-sites/json/system_core.php"] [unique_id "afx0evrIJCALdUrO43l0oAAAABc"]
[Thu May 07 19:16:10.813544 2026] [:error] [pid 28098:tid 28107] [client 85.203.23.181:57695] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/cartflows-logs/system_core.php"] [unique_id "afx0esvhwfljlt8trSrdzwAAAEc"]
[Thu May 07 19:16:10.998829 2026] [:error] [pid 15629:tid 15650] [client 85.203.23.211:24845] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/edd/system_core.php"] [unique_id "afx0evrIJCALdUrO43l0oQAAABE"]
[Thu May 07 19:16:11.205970 2026] [:error] [pid 28098:tid 28105] [client 85.203.23.181:21477] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/elementor/system_core.php"] [unique_id "afx0e8vhwfljlt8trSrd0AAAAEU"]
[Thu May 07 19:16:11.403710 2026] [:error] [pid 28098:tid 28121] [client 85.203.23.196:52625] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/simply-static/temp-files/system_core.php"] [unique_id "afx0e8vhwfljlt8trSrd0QAAAFU"]
[Thu May 07 19:16:11.605276 2026] [:error] [pid 28098:tid 28101] [client 85.203.23.195:56375] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/st-importer/system_core.php"] [unique_id "afx0e8vhwfljlt8trSrd0gAAAEE"]
[Thu May 07 19:16:11.806923 2026] [:error] [pid 28098:tid 28124] [client 85.203.23.200:42743] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/system_core.php"] [unique_id "afx0e8vhwfljlt8trSrd1AAAAFg"]
[Thu May 07 19:16:12.006310 2026] [:error] [pid 28098:tid 28119] [client 85.203.23.193:34907] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wc-logs/system_core.php"] [unique_id "afx0fMvhwfljlt8trSrd1wAAAFM"]
[Thu May 07 19:16:12.206374 2026] [:error] [pid 15629:tid 15651] [client 85.203.23.196:31983] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/woocommerce_uploads/system_core.php"] [unique_id "afx0fPrIJCALdUrO43l0pAAAABI"]
[Thu May 07 19:16:12.414466 2026] [:error] [pid 28098:tid 28111] [client 85.203.23.176:37337] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wpforms/cache/system_core.php"] [unique_id "afx0fMvhwfljlt8trSrd2AAAAEs"]
[Thu May 07 19:16:12.602627 2026] [:error] [pid 28098:tid 28116] [client 85.203.23.189:45801] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-file-manager-pro/"] [unique_id "afx0fMvhwfljlt8trSrd2QAAAFA"]
[Thu May 07 19:16:12.804473 2026] [:error] [pid 28098:tid 28107] [client 85.203.23.181:39761] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/db-status.php"] [unique_id "afx0fMvhwfljlt8trSrd2gAAAEc"]
[Thu May 07 19:16:18.234617 2026] [:error] [pid 15631:tid 15702] [client 85.203.23.177:27801] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/elementor/css/"] [unique_id "afx0gnvP1GkPUuuLfqU1AAAAAM8"]
[Thu May 07 19:16:18.424532 2026] [:error] [pid 15630:tid 15679] [client 85.203.23.199:52953] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-file-manager-pro/fm_backup/"] [unique_id "afx0gnTithRAi4821quuIgAAAJM"]
[Thu May 07 19:16:28.623553 2026] [:error] [pid 15631:tid 15706] [client 85.203.23.196:30209] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/system.php"] [unique_id "afx0jHvP1GkPUuuLfqU1FwAAANM"]
[Thu May 07 19:16:28.831272 2026] [:error] [pid 15631:tid 15688] [client 85.203.23.166:33431] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/panel.php"] [unique_id "afx0jHvP1GkPUuuLfqU1GQAAAME"]
[Thu May 07 19:16:29.018123 2026] [:error] [pid 15630:tid 15675] [client 85.203.23.208:39073] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/home.php"] [unique_id "afx0jXTithRAi4821quuKAAAAI8"]
[Thu May 07 19:16:29.212358 2026] [:error] [pid 15630:tid 15666] [client 85.203.23.201:42311] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp.php"] [unique_id "afx0jXTithRAi4821quuKQAAAIY"]
[Thu May 07 19:16:29.415687 2026] [:error] [pid 15631:tid 15697] [client 85.203.23.199:29429] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/login.php"] [unique_id "afx0jXvP1GkPUuuLfqU1HAAAAMo"]
[Thu May 07 19:16:39.618373 2026] [:error] [pid 28098:tid 28104] [client 85.203.23.196:31327] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/system_core.php"] [unique_id "afx0l8vhwfljlt8trSrd8gAAAEQ"]
[Thu May 07 19:16:39.901391 2026] [:error] [pid 15715:tid 15731] [client 85.203.23.220:26631] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/system_core.php"] [unique_id "afx0lyY4dZsLOttMkceVUwAAAQs"]
[Thu May 07 19:16:40.238267 2026] [:error] [pid 15715:tid 15739] [client 85.203.23.201:59497] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-json/oembed/system_core.php"] [unique_id "afx0mCY4dZsLOttMkceVVAAAARM"]
[Thu May 07 19:16:40.440812 2026] [:error] [pid 15715:tid 15733] [client 85.203.23.177:22787] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-json/system_core.php"] [unique_id "afx0mCY4dZsLOttMkceVVgAAAQ0"]
[Thu May 07 19:16:40.906487 2026] [:error] [pid 15715:tid 15719] [client 85.203.23.210:53485] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-json/wp/system_core.php"] [unique_id "afx0mCY4dZsLOttMkceVWAAAAQI"]
[Thu May 07 19:16:46.122504 2026] [:error] [pid 15629:tid 15655] [client 85.203.23.223:52013] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-content/wp-config-backup.php"] [unique_id "afx0nvrIJCALdUrO43l0twAAABY"]
[Thu May 07 19:16:46.319712 2026] [:error] [pid 15715:tid 15735] [client 85.203.23.188:52141] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-config.php"] [unique_id "afx0niY4dZsLOttMkceVYgAAAQ8"]
[Thu May 07 19:16:51.521225 2026] [:error] [pid 15629:tid 15636] [client 85.203.23.202:52437] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/elementor/assets/css/conditionals/system_core.php"] [unique_id "afx0o_rIJCALdUrO43l0uwAAAAM"]
[Thu May 07 19:16:51.708580 2026] [:error] [pid 15629:tid 15643] [client 85.203.23.176:23897] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/system_core.php"] [unique_id "afx0o_rIJCALdUrO43l0vAAAAAo"]
[Thu May 07 19:16:51.914349 2026] [:error] [pid 15629:tid 15644] [client 85.203.23.184:33291] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wpforms-lite/assets/css/frontend/modern/system_core.php"] [unique_id "afx0o_rIJCALdUrO43l0vQAAAAs"]
[Thu May 07 19:16:52.107871 2026] [:error] [pid 15629:tid 15646] [client 85.203.23.218:23397] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-content/plugins/wp-config-backup.php"] [unique_id "afx0pPrIJCALdUrO43l0vgAAAA0"]
[Thu May 07 19:16:52.306896 2026] [:error] [pid 15630:tid 15681] [client 85.203.23.210:57207] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-config-backup.php"] [unique_id "afx0pHTithRAi4821quuOgAAAJU"]
[Thu May 07 19:16:52.506729 2026] [:error] [pid 15629:tid 15639] [client 85.203.23.211:26885] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/cielhpn/"] [unique_id "afx0pPrIJCALdUrO43l0wQAAAAY"]
[Thu May 07 19:16:52.706945 2026] [:error] [pid 15715:tid 15725] [client 85.203.23.178:51125] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/elementor-pro/modules/loop-filter/data/endpoints/about.php"] [unique_id "afx0pCY4dZsLOttMkceVaAAAAQg"]
[Thu May 07 19:16:52.911039 2026] [:error] [pid 15629:tid 15653] [client 85.203.23.195:31305] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/forminator/library/field-autofill-providers/contracts/wp-login.php"] [unique_id "afx0pPrIJCALdUrO43l0wgAAABQ"]
[Thu May 07 19:16:53.112534 2026] [:error] [pid 15715:tid 15744] [client 85.203.23.171:38639] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/advanced-custom-fields-pro/includes/Updater/about.php"] [unique_id "afx0pSY4dZsLOttMkceVaQAAARg"]
[Thu May 07 19:16:53.315504 2026] [:error] [pid 15715:tid 15719] [client 85.203.23.188:24067] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/class-wp-logo.php"] [unique_id "afx0pSY4dZsLOttMkceVagAAAQI"]
[Thu May 07 19:16:58.524510 2026] [:error] [pid 15629:tid 15654] [client 85.203.23.197:41689] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/revslider/admin/assets/js/plugins/maintenance.php"] [unique_id "afx0qvrIJCALdUrO43l0xwAAABU"]
[Thu May 07 19:16:58.994847 2026] [:error] [pid 15630:tid 15669] [client 85.203.23.180:25783] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/contact-form-7/includes/js/jquery-ui/themes/wp-mail.php"] [unique_id "afx0qnTithRAi4821quuPQAAAIk"]
[Thu May 07 19:16:59.431521 2026] [:error] [pid 15629:tid 15635] [client 85.203.23.222:20011] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/sitepress-multilingual-cms/classes/plugins/wp-blog-header.php"] [unique_id "afx0q_rIJCALdUrO43l0yQAAAAI"]
[Thu May 07 19:16:59.623229 2026] [:error] [pid 15630:tid 15674] [client 85.203.23.197:58853] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/updraftplus/includes/jstree/themes/wp-activate.php"] [unique_id "afx0q3TithRAi4821quuPgAAAI4"]
[Thu May 07 19:17:04.810936 2026] [:error] [pid 15629:tid 15649] [client 85.203.23.177:23551] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-blog-header.php"] [unique_id "afx0sPrIJCALdUrO43l00gAAABA"]
[Thu May 07 19:17:10.011792 2026] [:error] [pid 28098:tid 28122] [client 85.203.23.169:21079] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/contact-form-7/uoyaugar.php"] [unique_id "afx0tsvhwfljlt8trSreBgAAAFY"]
[Thu May 07 19:17:10.235424 2026] [:error] [pid 28098:tid 28109] [client 85.203.23.193:51821] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/check-email/config.php"] [unique_id "afx0tsvhwfljlt8trSreBwAAAEk"]
[Thu May 07 19:17:10.416168 2026] [:error] [pid 28098:tid 28100] [client 85.203.23.203:27233] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/file-manager-advanced/config.php"] [unique_id "afx0tsvhwfljlt8trSreCQAAAEA"]
[Thu May 07 19:17:10.607508 2026] [:error] [pid 15715:tid 15742] [client 85.203.23.176:25177] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "afx0tiY4dZsLOttMkceVcwAAARY"]
[Thu May 07 19:17:10.838275 2026] [:error] [pid 15629:tid 15655] [client 85.203.23.181:45077] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/elementor/lndex.php"] [unique_id "afx0tvrIJCALdUrO43l04QAAABY"]
[Thu May 07 19:17:11.023681 2026] [:error] [pid 15629:tid 15642] [client 85.203.23.218:50637] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wordpress-seo/wp-seo-trigger-table.php"] [unique_id "afx0t_rIJCALdUrO43l04gAAAAk"]
[Thu May 07 19:17:11.220846 2026] [:error] [pid 15715:tid 15739] [client 85.203.23.223:57551] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-content/plugins/admin.php"] [unique_id "afx0tyY4dZsLOttMkceVdgAAARM"]
[Thu May 07 19:17:11.413063 2026] [:error] [pid 15629:tid 15637] [client 85.203.23.210:33747] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/star-addons-for-elementor/includes/class-star-addons-uploads.php"] [unique_id "afx0t_rIJCALdUrO43l04wAAAAQ"]
[Thu May 07 19:17:11.607728 2026] [:error] [pid 15631:tid 15702] [client 85.203.23.195:51731] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/contact-form-7-honeypot/includes/rest-api/wp-admin/config.php"] [unique_id "afx0t3vP1GkPUuuLfqU1MwAAAM8"]
[Thu May 07 19:17:11.810471 2026] [:error] [pid 15629:tid 15633] [client 85.203.23.215:33567] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/js_composer/include/classes/vendors/plugins/panel.php"] [unique_id "afx0t_rIJCALdUrO43l05AAAAAA"]
[Thu May 07 19:17:17.035265 2026] [:error] [pid 15715:tid 15743] [client 85.203.23.187:44517] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/updraftplus/includes/jstree/themes/config.php"] [unique_id "afx0vSY4dZsLOttMkceViQAAARc"]
[Thu May 07 19:17:22.238909 2026] [:error] [pid 28098:tid 28108] [client 85.203.23.218:57065] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/maintenance.php"] [unique_id "afx0wsvhwfljlt8trSreFQAAAEg"]
[Thu May 07 19:17:22.421227 2026] [:error] [pid 15715:tid 15743] [client 85.203.23.222:61477] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/tiktok-for-business/"] [unique_id "afx0wiY4dZsLOttMkceVlwAAARc"]
[Thu May 07 19:17:22.623446 2026] [:error] [pid 28098:tid 28110] [client 85.203.23.212:45529] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/contact-form-7/base-theme.php"] [unique_id "afx0wsvhwfljlt8trSreFwAAAEo"]
[Thu May 07 19:17:22.815737 2026] [:error] [pid 28098:tid 28102] [client 85.203.23.209:42439] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hello-plus/classes/ehp-bes.php"] [unique_id "afx0wsvhwfljlt8trSreGAAAAEI"]
[Thu May 07 19:17:28.004928 2026] [:error] [pid 15630:tid 15684] [client 85.203.23.221:50405] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-load.php"] [unique_id "afx0yHTithRAi4821quuXgAAAJg"]
[Thu May 07 19:17:28.307854 2026] [:error] [pid 15630:tid 15676] [client 85.203.23.205:46745] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/site-logo/about.php"] [unique_id "afx0yHTithRAi4821quuYQAAAJA"]
[Thu May 07 19:17:28.525185 2026] [:error] [pid 28098:tid 28113] [client 85.203.23.216:40913] [client 85.203.23.216] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/newfold-page-cachesocial/about.php"] [unique_id "afx0yMvhwfljlt8trSreIwAAAE0"]
[Thu May 07 19:17:28.847022 2026] [:error] [pid 15629:tid 15653] [client 85.203.23.201:65059] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/file61.php"] [unique_id "afx0yPrIJCALdUrO43l09wAAABQ"]
[Thu May 07 19:17:29.438716 2026] [:error] [pid 15629:tid 15641] [client 85.203.23.200:60471] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/comment-author-name/editers.php"] [unique_id "afx0yfrIJCALdUrO43l0-QAAAAg"]
[Thu May 07 19:17:29.626896 2026] [:error] [pid 15629:tid 15655] [client 85.203.23.188:23609] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/plugin-editor-trigger.php"] [unique_id "afx0yfrIJCALdUrO43l0-gAAABY"]
[Thu May 07 19:17:29.811139 2026] [:error] [pid 15629:tid 15654] [client 85.203.23.205:22139] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/query-pagination-numbers/wp-cron.php"] [unique_id "afx0yfrIJCALdUrO43l0_AAAABU"]
[Thu May 07 19:17:30.011755 2026] [:error] [pid 15715:tid 15720] [client 85.203.23.202:27383] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/autoload_classmap.php"] [unique_id "afx0yiY4dZsLOttMkceVogAAAQM"]
[Thu May 07 19:17:30.206753 2026] [:error] [pid 15715:tid 15723] [client 85.203.23.222:51763] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/upgrade-temp-backup/media/files/files/cache/ulnc/wbdo/"] [unique_id "afx0yiY4dZsLOttMkceVowAAAQY"]
[Thu May 07 19:17:30.407936 2026] [:error] [pid 15630:tid 15672] [client 85.203.23.188:31685] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/backup/js/build/kys/admin.php"] [unique_id "afx0ynTithRAi4821quuYwAAAIw"]
[Thu May 07 19:17:30.614920 2026] [:error] [pid 15629:tid 15656] [client 85.203.23.195:58045] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/src/v1/dist/build/uols/"] [unique_id "afx0yvrIJCALdUrO43l0_wAAABc"]
[Thu May 07 19:17:30.838395 2026] [:error] [pid 15631:tid 15704] [client 85.203.23.172:22637] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/css/cache/piwk/admin.php"] [unique_id "afx0ynvP1GkPUuuLfqU1XAAAANE"]
[Thu May 07 19:17:31.031710 2026] [:error] [pid 15629:tid 15646] [client 85.203.23.209:21833] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/plugins/test.php"] [unique_id "afx0y_rIJCALdUrO43l1AQAAAA0"]
[Thu May 07 19:17:31.216921 2026] [:error] [pid 15629:tid 15647] [client 85.203.23.201:37667] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/themes/maintenance.php"] [unique_id "afx0y_rIJCALdUrO43l1AgAAAA4"]
[Thu May 07 19:17:31.434080 2026] [:error] [pid 15630:tid 15677] [client 85.203.23.205:27793] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins_new/sitepress-multilingual-cms/classes/plugins/about.php"] [unique_id "afx0y3TithRAi4821quuZgAAAJE"]
[Thu May 07 19:17:31.618431 2026] [:error] [pid 15715:tid 15722] [client 85.203.23.171:39601] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins_new/wordpress-seo/admin/import/plugins/wp-blog-header.php"] [unique_id "afx0yyY4dZsLOttMkceVpgAAAQU"]
[Thu May 07 19:17:31.851833 2026] [:error] [pid 15715:tid 15734] [client 85.203.23.215:27611] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/cs.php"] [unique_id "afx0yyY4dZsLOttMkceVpwAAAQ4"]
[Thu May 07 19:17:32.228043 2026] [:error] [pid 15715:tid 15721] [client 85.203.23.225:25189] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/IXR/met/uploads/"] [unique_id "afx0zCY4dZsLOttMkceVqAAAAQQ"]
[Thu May 07 19:17:32.410312 2026] [:error] [pid 15629:tid 15655] [client 85.203.23.199:49185] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wdf.php"] [unique_id "afx0zPrIJCALdUrO43l1BgAAABY"]
[Thu May 07 19:17:32.604904 2026] [:error] [pid 15715:tid 15732] [client 85.203.23.201:56897] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/koiy.php"] [unique_id "afx0zCY4dZsLOttMkceVqQAAAQw"]
[Thu May 07 19:17:42.833483 2026] [:error] [pid 15715:tid 15737] [client 85.203.23.191:21777] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/"] [unique_id "afx01iY4dZsLOttMkceVuAAAARE"]
[Thu May 07 19:17:43.032489 2026] [:error] [pid 15630:tid 15660] [client 85.203.23.166:33941] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/plugins/media/v3/js/build/icdxa/"] [unique_id "afx013TithRAi4821quubgAAAIA"]
[Thu May 07 19:17:48.222632 2026] [:error] [pid 15715:tid 15739] [client 85.203.23.180:32879] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/upgrade/build/css/cache/img/src/backup/utt/admin.php"] [unique_id "afx03CY4dZsLOttMkceVxAAAARM"]
[Thu May 07 19:17:50.005683 2026] [:error] [pid 28098:tid 28114] [client 85.203.23.215:20965] [client 85.203.23.215] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/social-links/admin.php"] [unique_id "afx03svhwfljlt8trSreKQAAAE4"]
[Thu May 07 19:17:50.351510 2026] [:error] [pid 15631:tid 15700] [client 85.203.23.195:38947] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/admin-wolf.php"] [unique_id "afx03nvP1GkPUuuLfqU1fwAAAM0"]
[Thu May 07 19:17:50.531705 2026] [:error] [pid 15630:tid 15683] [client 85.203.23.222:51239] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/class-wp-wolf-widget.php"] [unique_id "afx03nTithRAi4821quufwAAAJc"]
[Thu May 07 19:17:50.717754 2026] [:error] [pid 15630:tid 15662] [client 85.203.23.189:27745] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/astra/assets/css/minified/system_core.php"] [unique_id "afx03nTithRAi4821quugAAAAII"]
[Thu May 07 19:17:50.920735 2026] [:error] [pid 15715:tid 15734] [client 85.203.23.176:57693] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/system_core.php"] [unique_id "afx03iY4dZsLOttMkceVxwAAAQ4"]
[Thu May 07 19:17:51.125989 2026] [:error] [pid 28098:tid 28115] [client 85.203.23.208:60519] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-content/themes/wp-config-backup.php"] [unique_id "afx038vhwfljlt8trSreKgAAAE8"]
[Thu May 07 19:17:51.335339 2026] [:error] [pid 15715:tid 15743] [client 85.203.23.187:36385] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/theme/about.php"] [unique_id "afx03yY4dZsLOttMkceVyAAAARc"]
[Thu May 07 19:17:51.548603 2026] [:error] [pid 28098:tid 28109] [client 85.203.23.217:59279] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/sinatra/inc/customizer/controls/color/about.php"] [unique_id "afx038vhwfljlt8trSreKwAAAEk"]
[Thu May 07 19:17:51.731773 2026] [:error] [pid 28098:tid 28118] [client 85.203.23.221:52321] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/blocksy/inc/panel-builder/footer/widget-area-3/"] [unique_id "afx038vhwfljlt8trSreLAAAAFI"]
[Thu May 07 19:17:51.940117 2026] [:error] [pid 28098:tid 28113] [client 85.203.23.169:60417] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/crio/woocommerce/notices/"] [unique_id "afx038vhwfljlt8trSreLQAAAE0"]
[Thu May 07 19:17:52.121461 2026] [:error] [pid 28098:tid 28120] [client 85.203.23.169:34429] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/hestia/inc/views/blog/"] [unique_id "afx04Mvhwfljlt8trSreLgAAAFQ"]
[Thu May 07 19:17:52.308399 2026] [:error] [pid 28098:tid 28104] [client 85.203.23.189:44109] [client 85.203.23.189] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/fortified-child/docs/js/omelv/"] [unique_id "afx04Mvhwfljlt8trSreLwAAAEQ"]
[Thu May 07 19:17:52.506114 2026] [:error] [pid 15630:tid 15673] [client 85.203.23.171:57411] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/maintenance.php"] [unique_id "afx04HTithRAi4821quuhAAAAI0"]
[Thu May 07 19:17:52.706575 2026] [:error] [pid 15715:tid 15726] [client 85.203.23.181:51115] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyone/content-index.php"] [unique_id "afx04CY4dZsLOttMkceVyQAAAQk"]
[Thu May 07 19:17:57.925198 2026] [:error] [pid 15630:tid 15664] [client 85.203.23.211:53833] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentythree/patterns/"] [unique_id "afx05XTithRAi4821quujAAAAIQ"]
[Thu May 07 19:18:03.235202 2026] [:error] [pid 15629:tid 15654] [client 85.203.23.187:30325] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/yootheme/content-index.php"] [unique_id "afx06_rIJCALdUrO43l1EwAAABU"]
[Thu May 07 19:18:03.647578 2026] [:error] [pid 15715:tid 15722] [client 85.203.23.197:32227] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/security.php"] [unique_id "afx06yY4dZsLOttMkceV0QAAAQU"]
[Thu May 07 19:18:03.847973 2026] [:error] [pid 28098:tid 28116] [client 85.203.23.196:56163] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/enfold/config-templatebuilder/avia-shortcodes/promobox/"] [unique_id "afx068vhwfljlt8trSreSAAAAFA"]
[Thu May 07 19:18:04.050342 2026] [:error] [pid 28098:tid 28105] [client 85.203.23.184:31483] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/wp-signup.php"] [unique_id "afx07Mvhwfljlt8trSreSQAAAEU"]
[Thu May 07 19:18:14.232980 2026] [:error] [pid 28098:tid 28103] [client 85.203.23.203:49225] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/villagio-child/admin.php"] [unique_id "afx09svhwfljlt8trSreVgAAAEM"]
[Thu May 07 19:18:14.441821 2026] [:error] [pid 28098:tid 28109] [client 85.203.23.173:37617] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentynineteen/sass/site/primary/"] [unique_id "afx09svhwfljlt8trSreVwAAAEk"]
[Thu May 07 19:18:14.627252 2026] [:error] [pid 28098:tid 28113] [client 85.203.23.181:24741] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-content/themes/admin.php"] [unique_id "afx09svhwfljlt8trSreWAAAAE0"]
[Thu May 07 19:18:19.814092 2026] [:error] [pid 15715:tid 15740] [client 85.203.23.222:43387] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/blogger-buzz/welcome/js/"] [unique_id "afx0-yY4dZsLOttMkceV5AAAARQ"]
[Thu May 07 19:18:20.006277 2026] [:error] [pid 15715:tid 15737] [client 85.203.23.195:57215] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/mesmerize/page-templates/"] [unique_id "afx0_CY4dZsLOttMkceV5gAAARE"]
[Thu May 07 19:18:20.234859 2026] [:error] [pid 15715:tid 15739] [client 85.203.23.203:40221] [client 85.203.23.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "afx0_CY4dZsLOttMkceV5wAAARM"]
[Thu May 07 19:18:20.416585 2026] [:error] [pid 15715:tid 15721] [client 85.203.23.218:60579] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/hello-elementor/template-parts/"] [unique_id "afx0_CY4dZsLOttMkceV6AAAAQQ"]
[Thu May 07 19:18:20.622835 2026] [:error] [pid 15715:tid 15743] [client 85.203.23.192:53695] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/Divi/includes/builder/post/taxonomy/"] [unique_id "afx0_CY4dZsLOttMkceV6QAAARc"]
[Thu May 07 19:18:20.824468 2026] [:error] [pid 15715:tid 15720] [client 85.203.23.210:62011] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/system.php"] [unique_id "afx0_CY4dZsLOttMkceV6gAAAQM"]
[Thu May 07 19:18:21.037116 2026] [:error] [pid 15715:tid 15734] [client 85.203.23.178:32771] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/module.php"] [unique_id "afx0_SY4dZsLOttMkceV6wAAAQ4"]
[Thu May 07 19:18:21.241798 2026] [:error] [pid 15715:tid 15733] [client 85.203.23.193:23185] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/test.php"] [unique_id "afx0_SY4dZsLOttMkceV7AAAAQ0"]
[Thu May 07 19:18:21.424688 2026] [:error] [pid 15715:tid 15724] [client 85.203.23.180:42065] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/blog-kit/inc/demo/demo-content/"] [unique_id "afx0_SY4dZsLOttMkceV7QAAAQc"]
[Thu May 07 19:18:21.713320 2026] [:error] [pid 15629:tid 15646] [client 85.203.23.225:22361] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/flatsome/inc/"] [unique_id "afx0_frIJCALdUrO43l1FwAAAA0"]
[Thu May 07 19:18:22.049628 2026] [:error] [pid 15629:tid 15647] [client 85.203.23.178:30535] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/config.php"] [unique_id "afx0_vrIJCALdUrO43l1GAAAAA4"]
[Thu May 07 19:18:22.233184 2026] [:error] [pid 15631:tid 15702] [client 85.203.23.185:65361] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/config.php"] [unique_id "afx0_nvP1GkPUuuLfqU1kAAAAM8"]
[Thu May 07 19:18:27.435195 2026] [:error] [pid 15715:tid 15735] [client 85.203.23.181:38715] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/config.php"] [unique_id "afx1AyY4dZsLOttMkceV_QAAAQ8"]
[Thu May 07 19:18:27.732126 2026] [:error] [pid 15630:tid 15663] [client 85.203.23.209:46567] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/bootstrap.php"] [unique_id "afx1A3TithRAi4821quungAAAIM"]
[Thu May 07 19:18:27.918913 2026] [:error] [pid 15629:tid 15655] [client 85.203.23.187:21801] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/plugins/panel.php"] [unique_id "afx1A_rIJCALdUrO43l1HgAAABY"]
[Thu May 07 19:18:28.109974 2026] [:error] [pid 15629:tid 15654] [client 85.203.23.201:37823] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/"] [unique_id "afx1BPrIJCALdUrO43l1HwAAABU"]
[Thu May 07 19:18:28.314727 2026] [:error] [pid 15629:tid 15652] [client 85.203.23.211:55383] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/class-wp-image.php"] [unique_id "afx1BPrIJCALdUrO43l1IAAAABM"]
[Thu May 07 19:18:28.513639 2026] [:error] [pid 15715:tid 15730] [client 85.203.23.201:38365] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/chosen.php"] [unique_id "afx1BCY4dZsLOttMkceWAQAAAQo"]
[Thu May 07 19:18:28.736867 2026] [:error] [pid 15629:tid 15633] [client 85.203.23.178:53769] [client 85.203.23.178] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/php-compat/shadow-bot.php"] [unique_id "afx1BPrIJCALdUrO43l1IgAAAAA"]
[Thu May 07 19:18:33.929121 2026] [:error] [pid 15629:tid 15645] [client 85.203.23.191:52515] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/config.php"] [unique_id "afx1CfrIJCALdUrO43l1JwAAAAw"]
[Thu May 07 19:18:34.613225 2026] [:error] [pid 15715:tid 15739] [client 85.203.23.184:62189] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/src/config.php"] [unique_id "afx1CiY4dZsLOttMkceWFgAAARM"]
[Thu May 07 19:18:34.816394 2026] [:error] [pid 28098:tid 28107] [client 85.203.23.173:46635] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/config.php"] [unique_id "afx1Csvhwfljlt8trSreXgAAAEc"]
[Thu May 07 19:18:35.005709 2026] [:error] [pid 28098:tid 28103] [client 85.203.23.193:27269] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/config.php"] [unique_id "afx1C8vhwfljlt8trSreYAAAAEM"]
[Thu May 07 19:18:35.208276 2026] [:error] [pid 28098:tid 28109] [client 85.203.23.180:25795] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/config.php"] [unique_id "afx1C8vhwfljlt8trSreYgAAAEk"]
[Thu May 07 19:18:35.424628 2026] [:error] [pid 15629:tid 15650] [client 85.203.23.193:39565] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/config.php"] [unique_id "afx1C_rIJCALdUrO43l1KgAAABE"]
[Thu May 07 19:18:35.606144 2026] [:error] [pid 15629:tid 15654] [client 85.203.23.196:44865] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/config.php"] [unique_id "afx1C_rIJCALdUrO43l1LAAAABU"]
[Thu May 07 19:18:35.805556 2026] [:error] [pid 28098:tid 28108] [client 85.203.23.202:21977] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/config.php"] [unique_id "afx1C8vhwfljlt8trSreZwAAAEg"]
[Thu May 07 19:18:36.024974 2026] [:error] [pid 15715:tid 15732] [client 85.203.23.170:47203] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/plugins/config.php"] [unique_id "afx1DCY4dZsLOttMkceWHQAAAQw"]
[Thu May 07 19:18:41.336875 2026] [:error] [pid 28098:tid 28101] [client 85.203.23.192:32733] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/cache/config.php"] [unique_id "afx1Ecvhwfljlt8trSredwAAAEE"]
[Thu May 07 19:18:41.519457 2026] [:error] [pid 28098:tid 28115] [client 85.203.23.218:36345] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-cloudflare-super-page-cache/config.php"] [unique_id "afx1Ecvhwfljlt8trSreeAAAAE8"]
[Thu May 07 19:18:46.718003 2026] [:error] [pid 15631:tid 15707] [client 85.203.23.221:24005] [client 85.203.23.221] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/abilities-api/"] [unique_id "afx1FnvP1GkPUuuLfqU1pgAAANQ"]
[Thu May 07 19:18:46.907166 2026] [:error] [pid 15629:tid 15657] [client 85.203.23.199:27753] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/loco/"] [unique_id "afx1FvrIJCALdUrO43l1MgAAABg"]
[Thu May 07 19:18:47.103781 2026] [:error] [pid 15629:tid 15644] [client 85.203.23.218:51755] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/upgrade-temp-backup/"] [unique_id "afx1F_rIJCALdUrO43l1MwAAAAs"]
[Thu May 07 19:18:47.319081 2026] [:error] [pid 15715:tid 15731] [client 85.203.23.170:54439] [client 85.203.23.170] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/includes/class-theme-installer-skin-client.php"] [unique_id "afx1FyY4dZsLOttMkceWKwAAAQs"]
[Thu May 07 19:18:47.515958 2026] [:error] [pid 15715:tid 15725] [client 85.203.23.195:24385] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-recovery-mode-link-service-edit.php"] [unique_id "afx1FyY4dZsLOttMkceWLQAAAQg"]
[Thu May 07 19:18:47.704948 2026] [:error] [pid 28098:tid 28110] [client 85.203.23.205:43941] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user-new-reference.php"] [unique_id "afx1F8vhwfljlt8trSrehwAAAEo"]
[Thu May 07 19:18:47.925972 2026] [:error] [pid 15629:tid 15649] [client 85.203.23.211:65215] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/vendor/stripe/stripe-php/lib/FinancialConnections/"] [unique_id "afx1F_rIJCALdUrO43l1NQAAABA"]
[Thu May 07 19:18:49.650022 2026] [:error] [pid 28098:tid 28112] [client 85.203.23.200:44283] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/vendor/stripe/stripe-php/lib/Service/FinancialConnections/"] [unique_id "afx1Gcvhwfljlt8trSrejQAAAEw"]
[Thu May 07 19:18:49.831394 2026] [:error] [pid 15630:tid 15668] [client 85.203.23.195:51097] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/post-excerpt-meta.php"] [unique_id "afx1GXTithRAi4821quusAAAAIg"]
[Thu May 07 19:18:50.018834 2026] [:error] [pid 28098:tid 28101] [client 85.203.23.200:58885] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/module.audio-video.riff-http.php"] [unique_id "afx1Gsvhwfljlt8trSrejwAAAEE"]
[Thu May 07 19:18:50.238291 2026] [:error] [pid 15631:tid 15694] [client 85.203.23.210:39101] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/admin.php"] [unique_id "afx1GnvP1GkPUuuLfqU1qQAAAMc"]
[Thu May 07 19:18:50.438327 2026] [:error] [pid 15631:tid 15692] [client 85.203.23.185:38411] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/admin.php"] [unique_id "afx1GnvP1GkPUuuLfqU1qgAAAMU"]
[Thu May 07 19:18:50.618864 2026] [:error] [pid 15631:tid 15702] [client 85.203.23.201:48981] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/html-api/wp-conflg.php"] [unique_id "afx1GnvP1GkPUuuLfqU1qwAAAM8"]
[Thu May 07 19:18:51.095915 2026] [:error] [pid 15631:tid 15693] [client 85.203.23.209:27187] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/thickbox/logs1.php"] [unique_id "afx1G3vP1GkPUuuLfqU1rQAAAMY"]
[Thu May 07 19:18:51.399873 2026] [:error] [pid 28098:tid 28114] [client 85.203.23.177:65299] [client 85.203.23.177] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/admin.php"] [unique_id "afx1G8vhwfljlt8trSrekAAAAE4"]
[Thu May 07 19:18:51.612427 2026] [:error] [pid 28098:tid 28110] [client 85.203.23.211:52717] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/xy.php"] [unique_id "afx1G8vhwfljlt8trSrekQAAAEo"]
[Thu May 07 19:18:51.804930 2026] [:error] [pid 28098:tid 28105] [client 85.203.23.176:45069] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/xy.php"] [unique_id "afx1G8vhwfljlt8trSrekgAAAEU"]
[Thu May 07 19:18:51.999066 2026] [:error] [pid 15630:tid 15684] [client 85.203.23.187:51179] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/footer-class.php"] [unique_id "afx1G3TithRAi4821quusQAAAJg"]
[Thu May 07 19:18:52.220430 2026] [:error] [pid 28098:tid 28100] [client 85.203.23.181:61535] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/good.php"] [unique_id "afx1HMvhwfljlt8trSrekwAAAEA"]
[Thu May 07 19:18:52.407529 2026] [:error] [pid 28098:tid 28103] [client 85.203.23.200:53741] [client 85.203.23.200] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/editor/"] [unique_id "afx1HMvhwfljlt8trSrelAAAAEM"]
[Thu May 07 19:18:52.620913 2026] [:error] [pid 15630:tid 15664] [client 85.203.23.192:48267] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/profile/admin.php"] [unique_id "afx1HHTithRAi4821quuswAAAIQ"]
[Thu May 07 19:18:52.805870 2026] [:error] [pid 28098:tid 28112] [client 85.203.23.192:51121] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/summia/"] [unique_id "afx1HMvhwfljlt8trSrelgAAAEw"]
[Thu May 07 19:18:52.999599 2026] [:error] [pid 28098:tid 28101] [client 85.203.23.195:36877] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-content/languages/config.php"] [unique_id "afx1HMvhwfljlt8trSrelwAAAEE"]
[Thu May 07 19:18:53.210620 2026] [:error] [pid 15629:tid 15654] [client 85.203.23.176:39471] [client 85.203.23.176] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-content/admin.php"] [unique_id "afx1HfrIJCALdUrO43l1NwAAABU"]
[Thu May 07 19:18:53.409693 2026] [:error] [pid 15629:tid 15641] [client 85.203.23.187:24319] [client 85.203.23.187] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "afx1HfrIJCALdUrO43l1OAAAAAg"]
[Thu May 07 19:18:53.621607 2026] [:error] [pid 28098:tid 28113] [client 85.203.23.212:32709] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/h2.php"] [unique_id "afx1Hcvhwfljlt8trSremgAAAE0"]
[Thu May 07 19:18:53.806384 2026] [:error] [pid 15629:tid 15640] [client 85.203.23.225:27361] [client 85.203.23.225] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/mu-plugins/chosen.php"] [unique_id "afx1HfrIJCALdUrO43l1OQAAAAc"]
[Thu May 07 19:18:54.001655 2026] [:error] [pid 28098:tid 28106] [client 85.203.23.208:48235] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/upgrade-temp-backup/autoload_classmap.php"] [unique_id "afx1Hsvhwfljlt8trSrenAAAAEY"]
[Thu May 07 19:18:54.202084 2026] [:error] [pid 28098:tid 28121] [client 85.203.23.169:61639] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/images/Base.php"] [unique_id "afx1Hsvhwfljlt8trSrenQAAAFU"]
[Thu May 07 19:18:54.402524 2026] [:error] [pid 15631:tid 15707] [client 85.203.23.208:36673] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins.bk/contact-form-7/includes/js/jquery-ui/themes/admin.php"] [unique_id "afx1HnvP1GkPUuuLfqU1sgAAANQ"]
[Thu May 07 19:18:59.616116 2026] [:error] [pid 28098:tid 28103] [client 85.203.23.223:38751] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins.bk/wordpress-seo/admin/import/plugins/maintenance.php"] [unique_id "afx1I8vhwfljlt8trSrerAAAAEM"]
[Thu May 07 19:19:04.818782 2026] [:error] [pid 28098:tid 28107] [client 85.203.23.173:42621] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/wp-conflg.php"] [unique_id "afx1KMvhwfljlt8trSretgAAAEc"]
[Thu May 07 19:19:05.017218 2026] [:error] [pid 15629:tid 15647] [client 85.203.23.222:35335] [client 85.203.23.222] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "wp-config.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/wp-config.php"] [unique_id "afx1KfrIJCALdUrO43l1PAAAAA4"]
[Thu May 07 19:19:05.210574 2026] [:error] [pid 15630:tid 15678] [client 85.203.23.180:57939] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/user/lock.php"] [unique_id "afx1KXTithRAi4821quutAAAAJI"]
[Thu May 07 19:19:05.414726 2026] [:error] [pid 15631:tid 15709] [client 85.203.23.196:65319] [client 85.203.23.196] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/com.php"] [unique_id "afx1KXvP1GkPUuuLfqU1uAAAANY"]
[Thu May 07 19:19:05.608332 2026] [:error] [pid 15629:tid 15651] [client 85.203.23.199:31769] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/xxx.php"] [unique_id "afx1KfrIJCALdUrO43l1PQAAABI"]
[Thu May 07 19:19:10.811621 2026] [:error] [pid 15631:tid 15691] [client 85.203.23.202:58909] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/plugins/colors/"] [unique_id "afx1LnvP1GkPUuuLfqU1wQAAAMQ"]
[Thu May 07 19:19:16.042506 2026] [:error] [pid 15631:tid 15690] [client 85.203.23.199:39945] [client 85.203.23.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/ai1wm-backups/includes/"] [unique_id "afx1NHvP1GkPUuuLfqU1yQAAAMM"]
[Thu May 07 19:19:16.635102 2026] [:error] [pid 15631:tid 15691] [client 85.203.23.201:27157] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/gettest.php"] [unique_id "afx1NHvP1GkPUuuLfqU1ygAAAMQ"]
[Thu May 07 19:19:16.850348 2026] [:error] [pid 15715:tid 15735] [client 85.203.23.193:42633] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/dx.php"] [unique_id "afx1NCY4dZsLOttMkceWMQAAAQ8"]
[Thu May 07 19:19:17.032252 2026] [:error] [pid 15715:tid 15744] [client 85.203.23.188:55781] [client 85.203.23.188] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/panel.php"] [unique_id "afx1NSY4dZsLOttMkceWMgAAARg"]
[Thu May 07 19:19:17.234373 2026] [:error] [pid 15629:tid 15635] [client 85.203.23.220:49737] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/wp-themes.php"] [unique_id "afx1NfrIJCALdUrO43l1RQAAAAI"]
[Thu May 07 19:19:17.427493 2026] [:error] [pid 15630:tid 15675] [client 85.203.23.211:49641] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/widgets/maint/"] [unique_id "afx1NXTithRAi4821quutwAAAI8"]
[Thu May 07 19:19:22.693972 2026] [:error] [pid 15631:tid 15695] [client 85.203.23.171:60401] [client 85.203.23.171] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/"] [unique_id "afx1OnvP1GkPUuuLfqU1zgAAAMg"]
[Thu May 07 19:19:23.245028 2026] [:error] [pid 28098:tid 28102] [client 85.203.23.181:37985] [client 85.203.23.181] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/wp-sing.php"] [unique_id "afx1O8vhwfljlt8trSrexQAAAEI"]
[Thu May 07 19:19:25.017124 2026] [:error] [pid 15629:tid 15642] [client 85.203.23.172:22245] [client 85.203.23.172] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/button/"] [unique_id "afx1PfrIJCALdUrO43l1TgAAAAk"]
[Thu May 07 19:19:25.226856 2026] [:error] [pid 15629:tid 15654] [client 85.203.23.212:51657] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/media-text/"] [unique_id "afx1PfrIJCALdUrO43l1TwAAABU"]
[Thu May 07 19:19:25.409403 2026] [:error] [pid 15630:tid 15673] [client 85.203.23.212:63973] [client 85.203.23.212] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/missing/"] [unique_id "afx1PXTithRAi4821quuugAAAI0"]
[Thu May 07 19:19:25.615225 2026] [:error] [pid 15629:tid 15640] [client 85.203.23.209:49579] [client 85.203.23.209] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wmore1.php"] [unique_id "afx1PfrIJCALdUrO43l1UAAAAAc"]
[Thu May 07 19:19:25.809289 2026] [:error] [pid 15629:tid 15635] [client 85.203.23.195:28105] [client 85.203.23.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/img/content/media/lnl/"] [unique_id "afx1PfrIJCALdUrO43l1UQAAAAI"]
[Thu May 07 19:19:26.018539 2026] [:error] [pid 15629:tid 15646] [client 85.203.23.169:21161] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/gallery/"] [unique_id "afx1PvrIJCALdUrO43l1UgAAAA0"]
[Thu May 07 19:19:26.207865 2026] [:error] [pid 15629:tid 15637] [client 85.203.23.166:26007] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/l10n/includes/content/v2/uploads/docs/yat/admin.php"] [unique_id "afx1PvrIJCALdUrO43l1UwAAAAQ"]
[Thu May 07 19:19:26.423263 2026] [:error] [pid 15715:tid 15743] [client 85.203.23.210:36373] [client 85.203.23.210] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/cache/adminkontol.php"] [unique_id "afx1PiY4dZsLOttMkceWNQAAARc"]
[Thu May 07 19:19:26.725352 2026] [:error] [pid 28098:tid 28122] [client 85.203.23.211:25283] [client 85.203.23.211] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/vx.php"] [unique_id "afx1Psvhwfljlt8trSrexwAAAFY"]
[Thu May 07 19:19:31.915944 2026] [:error] [pid 15715:tid 15723] [client 85.203.23.192:60719] [client 85.203.23.192] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/uploads/system.php"] [unique_id "afx1QyY4dZsLOttMkceWNwAAAQY"]
[Thu May 07 19:19:32.120149 2026] [:error] [pid 15629:tid 15645] [client 85.203.23.197:61609] [client 85.203.23.197] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/block/img/themes/"] [unique_id "afx1RPrIJCALdUrO43l1VgAAAAw"]
[Thu May 07 19:19:33.547582 2026] [:error] [pid 15631:tid 15711] [client 85.203.23.223:37749] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/preformatted/"] [unique_id "afx1RXvP1GkPUuuLfqU10gAAANg"]
[Thu May 07 19:19:39.048029 2026] [:error] [pid 15631:tid 15692] [client 85.203.23.184:52943] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/plugins/home.php"] [unique_id "afx1S3vP1GkPUuuLfqU10wAAAMU"]
[Thu May 07 19:19:39.806882 2026] [:error] [pid 28098:tid 28114] [client 85.203.23.169:47665] [client 85.203.23.169] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/themes/"] [unique_id "afx1S8vhwfljlt8trSreywAAAE4"]
[Thu May 07 19:19:40.536272 2026] [:error] [pid 28098:tid 28117] [client 85.203.23.166:31023] [client 85.203.23.166] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/system_core.php"] [unique_id "afx1TMvhwfljlt8trSrezAAAAFE"]
[Thu May 07 19:19:40.752385 2026] [:error] [pid 28098:tid 28124] [client 85.203.23.208:54623] [client 85.203.23.208] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/maintenance.php"] [unique_id "afx1TMvhwfljlt8trSrezQAAAFg"]
[Thu May 07 19:19:40.936963 2026] [:error] [pid 15630:tid 15669] [client 85.203.23.201:60583] [client 85.203.23.201] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/edit-tags.php"] [unique_id "afx1THTithRAi4821quuvwAAAIk"]
[Thu May 07 19:19:41.134589 2026] [:error] [pid 15630:tid 15677] [client 85.203.23.180:64939] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/w.php"] [unique_id "afx1TXTithRAi4821quuwAAAAJE"]
[Thu May 07 19:19:41.330713 2026] [:error] [pid 28098:tid 28110] [client 85.203.23.202:28447] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/class-wp-http-client.php"] [unique_id "afx1Tcvhwfljlt8trSrezgAAAEo"]
[Thu May 07 19:19:41.522620 2026] [:error] [pid 28098:tid 28102] [client 85.203.23.220:62125] [client 85.203.23.220] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/class-wp-http-client.php"] [unique_id "afx1Tcvhwfljlt8trSrezwAAAEI"]
[Thu May 07 19:19:41.728021 2026] [:error] [pid 28098:tid 28106] [client 85.203.23.184:45563] [client 85.203.23.184] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/tag-cloud/"] [unique_id "afx1Tcvhwfljlt8trSre0AAAAEY"]
[Thu May 07 19:19:42.119761 2026] [:error] [pid 15715:tid 15739] [client 85.203.23.205:34465] [client 85.203.23.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/nic.php"] [unique_id "afx1TiY4dZsLOttMkceWPAAAARM"]
[Thu May 07 19:19:42.421277 2026] [:error] [pid 15715:tid 15721] [client 85.203.23.191:57927] [client 85.203.23.191] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/wp-conflg.php"] [unique_id "afx1TiY4dZsLOttMkceWPQAAAQQ"]
[Thu May 07 19:19:42.607630 2026] [:error] [pid 28098:tid 28111] [client 85.203.23.193:65489] [client 85.203.23.193] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-conflg.php"] [unique_id "afx1Tsvhwfljlt8trSre0QAAAEs"]
[Thu May 07 19:19:47.833741 2026] [:error] [pid 28098:tid 28117] [client 85.203.23.202:20287] [client 85.203.23.202] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/theme-compat/autoload_classmap.php"] [unique_id "afx1U8vhwfljlt8trSre2gAAAFE"]
[Thu May 07 19:19:48.029137 2026] [:error] [pid 15631:tid 15702] [client 85.203.23.180:23151] [client 85.203.23.180] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/autoload_classmap.php"] [unique_id "afx1VHvP1GkPUuuLfqU11AAAAM8"]
[Thu May 07 19:19:53.216142 2026] [:error] [pid 15631:tid 15701] [client 85.203.23.185:63409] [client 85.203.23.185] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/plugins/core.php"] [unique_id "afx1WXvP1GkPUuuLfqU11QAAAM4"]
[Thu May 07 19:19:58.415894 2026] [:error] [pid 28098:tid 28113] [client 85.203.23.173:65203] [client 85.203.23.173] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/block-library/includes/"] [unique_id "afx1Xsvhwfljlt8trSre-QAAAE0"]
[Thu May 07 19:19:58.633842 2026] [:error] [pid 15630:tid 15677] [client 85.203.23.218:35849] [client 85.203.23.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/base-styles/user/"] [unique_id "afx1XnTithRAi4821quuzwAAAJE"]
[Thu May 07 19:19:58.823361 2026] [:error] [pid 15630:tid 15666] [client 85.203.23.217:44785] [client 85.203.23.217] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/abilities-api/Parse/"] [unique_id "afx1XnTithRAi4821quu0QAAAIY"]
[Thu May 07 19:19:59.020752 2026] [:error] [pid 15630:tid 15671] [client 85.203.23.223:30493] [client 85.203.23.223] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/providers/html-api/"] [unique_id "afx1X3TithRAi4821quu1AAAAIs"]
[Thu May 07 22:38:37.350284 2026] [:error] [pid 28098:tid 28109] [client 196.206.123.211:52023] [client 196.206.123.211] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 196.206.123.211, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "afyj7cvhwfljlt8trSoo6wAAAEk"]
[Fri May 08 08:33:45.909088 2026] [:error] [pid 61356:tid 61401] [client 35.228.196.253:34108] [client 35.228.196.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "af0vaYx3vpB8oWhUq2OnxgAAAc0"]
[Fri May 08 14:53:50.277401 2026] [:error] [pid 51113:tid 51137] [client 20.219.129.204:31405] [client 20.219.129.204] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.129.204, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "af2IfkQfs7sWtqkpQIdbLgAAANY"]
[Fri May 08 14:53:50.723686 2026] [:error] [pid 51113:tid 51126] [client 20.219.129.204:31405] [client 20.219.129.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine.php"] [unique_id "af2IfkQfs7sWtqkpQIdbMQAAAMs"]
[Fri May 08 14:53:51.883455 2026] [proxy_fcgi:error] [pid 61356:tid 61405] [client 20.219.129.204:28250] AH01071: Got error 'Primary script unknown'
[Fri May 08 14:53:54.349404 2026] [:error] [pid 61356:tid 61398] [client 20.219.129.204:28250] [client 20.219.129.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/ty.php"] [unique_id "af2Igox3vpB8oWhUq2Mp5gAAAco"]
[Fri May 08 14:54:01.185832 2026] [:error] [pid 34318:tid 34338] [client 20.219.129.204:31320] [client 20.219.129.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/interactivity-api/index.php"] [unique_id "af2Iicr3guirgJiKhzC5JAAAARI"]
[Fri May 08 14:54:01.759683 2026] [:error] [pid 61355:tid 61363] [client 20.219.129.204:31298] [client 20.219.129.204] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.219.129.204, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "af2IifkhJTi30CBXmMlXgwAAAYI"]
[Fri May 08 14:54:06.787765 2026] [:error] [pid 61355:tid 61376] [client 20.219.129.204:31298] [client 20.219.129.204] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "af2IjvkhJTi30CBXmMlXnwAAAY8"]
[Fri May 08 15:22:56.028842 2026] [:error] [pid 61356:tid 61403] [client 34.17.25.88:48078] [client 34.17.25.88] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "af2PUIx3vpB8oWhUq2Mz_AAAAc8"]
[Fri May 08 15:28:58.338351 2026] [:error] [pid 61355:tid 61383] [client 34.122.144.100:52509] [client 34.122.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "af2QuvkhJTi30CBXmMleyAAAAZY"]
[Fri May 08 15:28:58.784481 2026] [:error] [pid 51009:tid 51099] [client 34.122.144.100:61502] [client 34.122.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "af2QuuB0GbUWhxgzX9X42wAAAJc"]
[Fri May 08 15:28:59.220565 2026] [:error] [pid 51009:tid 51099] [client 34.122.144.100:64652] [client 34.122.144.100] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "af2Qu-B0GbUWhxgzX9X45AAAAJc"]
[Sat May 09 01:31:03.895637 2026] [:error] [pid 61355:tid 61361] [client 34.254.154.62:46722] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "af4d1_khJTi30CBXmMkuHgAAAYA"]
[Sat May 09 01:31:04.990031 2026] [:error] [pid 51008:tid 51053] [client 34.254.154.62:42102] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.env/.env.local/.env.production/.env.staging/.env.development/.env.test/.env.remote/.env.bak/.env.backup/.env.save/.env.old/.env.sample/.env.example/.env.dev/.env.prod/.env.stage/.env.ci/.env.docker/.env.live/.env.preprod/.env.uat/.env.dist/.env.swp/.env~/.env1/.env2/.env_copy/.env.txt/.env.json/.env.yaml/.env.yml/app/.env/apps/.env/api/.env/web/.env/site/.env/public/.env/admin/.env/backend/.env/server/.env/frontend/.env/src/.env/core/.env/core/app/.env/config/.env/private/.env/application/.env/bootstrap/.env/database/.env/storage/.env/var/www/.env/var/www/html/.env/current/.env/release/.env/releases/.env/shared/.env/deploy/.env/build/.env/dist/.env/public_html/.env/htdocs/.env/www/.env/html/.env/live/.env/prod/.env/dev/.env/staging/.env/opt/.env/laravel/.env/symfony/.env/wordpress/.env/wp/.env/cms/.env/drupal/.env/joomla/.env/magento/.env/shopify/.env/prestashop/.env/codeigniter/.env/cakephp/.env/zend/.env/yii/.env/laravel5/.env/v1/.env/v2/.env/v3/.env/api/v1/.env/api/v2/.env/rest/.env/graphql/.env/gateway/.env/microservice/.env/service/.env/api/v3/.env/api/dev/.env/api/staging/.env/vendor/.env/lib/.env/resources/.env/assets/.env/uploads/.env/internal/.env/tools/.env/scripts/.env/bin/.env/sbin/.env/local/.env/portal/.env/dashboard/.env/panel/.env/crm/.env/erp/.env/shop/.env/store/.env/saas/.env/client/.env/project/.env/admin-panel/.env/control-panel/.env/user-panel/.env/node/.env/express/.env/next/.env/nuxt/.env/nest/.env/react/.env/vue/.env/angular/.env/svelte/.env/vite/.env/backup/.env/backups/.env/old/.env/tmp/.env/temp/.env/lab/.env/cronlab/.env/cron/.env/en/.env/administrator/.env/psnlink/.env/exapi/.env/sitemaps/.env/.env.backup1/.env.backup2/logs/.env/cache/.env/mailer/.env/mail/.env/email/.env/smtp/.env/mailing/.env/notifications/.env/notify/.env/sender/.env/campaign/.env/newsletter/.env/ses/.env/sendgrid/.env/sparkpost/.env/postmark/.env/mailgun/.env/mandrill/.env/mailjet/.env/brevo/.env/transactional/.env/bulk/.env/aws/.env/azure/.env/gcp/.env/cloud/.env/infrastructure/.env/docker/.env/k8s/.env/kubernetes/.env/terraform/.env/ansible/.env/.git/.env/ci/.env/cd/.env/jenkins/.env/gitlab/.env/github/.env/actions/.env/circleci/.env/travis/.env/buildkite/.env/mysql/.env/postgres/.env/mongodb/.env/redis/.env/elasticsearch/.env/rabbitmq/.env/kafka/.env/queue/.env/worker/.env/job/.env/test/.env/qa/.env/preview/.env/beta/.env/uat/.env/stage/.env/development/.env/production/.env/config/app/.env"] [unique_id "af4d2HB58C2Y1tgLtuLaSgAAAEQ"]
[Sat May 09 01:31:24.146894 2026] [:error] [pid 51008:tid 51073] [client 34.254.154.62:42142] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com.au|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com.au"] [uri "/phpinfo.php.bak"] [unique_id "af4d7HB58C2Y1tgLtuLaeQAAAFg"]
[Sat May 09 01:31:24.405281 2026] [:error] [pid 51008:tid 51061] [client 34.254.154.62:42142] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com.au|F|2"] [data ".php.old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com.au"] [uri "/phpinfo.php.old"] [unique_id "af4d7HB58C2Y1tgLtuLaewAAAEw"]
[Sat May 09 01:31:25.189871 2026] [:error] [pid 51008:tid 51064] [client 34.254.154.62:42142] [client 34.254.154.62] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||www.paramountestate.com.au|F|2"] [data ".php.bak"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com.au"] [uri "/info.php.bak"] [unique_id "af4d7XB58C2Y1tgLtuLafQAAAE8"]
[Sat May 09 04:00:18.888009 2026] [:error] [pid 9186:tid 9228] [client 45.92.229.123:62387] [client 45.92.229.123] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 45.92.229.123, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "af5A0hW4eFOEw1mKOgJfBAAAAEI"]
[Sat May 09 10:15:22.667543 2026] [:error] [pid 9184:tid 9213] [client 172.71.164.9:10097] [client 172.71.164.9] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "af6YuojfODqb_i0Fm991xwAAABA"], referer: https://www.google.com/search?q=paramountestate.com.au
[Sat May 09 10:15:23.704151 2026] [:error] [pid 9184:tid 9198] [client 162.158.111.205:13565] [client 162.158.111.205] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.env"] [unique_id "af6Yu4jfODqb_i0Fm991yQAAAAE"], referer: https://www.google.com/search?q=www.paramountestate.com.au
[Sat May 09 10:19:46.056426 2026] [:error] [pid 9186:tid 9226] [client 20.151.175.120:23834] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wk/index.php"] [unique_id "af6ZwhW4eFOEw1mKOgKjVQAAAEA"]
[Sat May 09 10:19:46.899024 2026] [:error] [pid 9184:tid 9204] [client 20.151.175.120:23890] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wk/index.php"] [unique_id "af6ZwojfODqb_i0Fm992gwAAAAc"]
[Sat May 09 10:19:48.123864 2026] [:error] [pid 9663:tid 9684] [client 20.151.175.120:23895] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wk/index.php"] [unique_id "af6ZxJcWIu01SCxbjwv_TQAAARI"]
[Sat May 09 10:19:48.981408 2026] [:error] [pid 9760:tid 9775] [client 20.151.175.120:23837] [client 20.151.175.120] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wk/index.php"] [unique_id "af6ZxGIkCp-C_fh0s7IlDgAAAUk"]
[Sat May 09 11:56:58.854313 2026] [:error] [pid 9833:tid 9838] [client 20.220.146.147:43011] [client 20.220.146.147] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.220.146.147, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "af6wiiM9JmxIS0KGZUBmowAAAYA"]
[Sat May 09 11:57:00.800358 2026] [:error] [pid 9833:tid 9844] [client 20.220.146.147:43011] [client 20.220.146.147] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.220.146.147, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "af6wjCM9JmxIS0KGZUBmrQAAAYY"]
[Sat May 09 11:57:05.567889 2026] [:error] [pid 9833:tid 9845] [client 20.220.146.147:43011] [client 20.220.146.147] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "af6wkSM9JmxIS0KGZUBmwQAAAYc"]
[Sat May 09 12:48:35.234926 2026] [:error] [pid 9293:tid 9317] [client 20.206.86.59:39278] [client 20.206.86.59] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.206.86.59, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "af68o5R__qEzV5O6Z2N0VgAAANQ"]
[Sat May 09 12:48:39.571773 2026] [:error] [pid 9293:tid 9321] [client 20.206.86.59:39278] [client 20.206.86.59] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.206.86.59, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "af68p5R__qEzV5O6Z2N0XwAAANg"]
[Sat May 09 12:48:46.338023 2026] [:error] [pid 9293:tid 9317] [client 20.206.86.59:39278] [client 20.206.86.59] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "af68rpR__qEzV5O6Z2N0bwAAANQ"]
[Sat May 09 14:01:32.524364 2026] [:error] [pid 9187:tid 9256] [client 34.65.156.190:36884] [client 34.65.156.190] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "af7NvBC7An6gkXsRsaF5ygAAAIM"]
[Sat May 09 14:23:18.282021 2026] [:error] [pid 9293:tid 9308] [client 20.151.175.120:41894] [client 20.151.175.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/wp-login.php"] [unique_id "af7S1pR__qEzV5O6Z2ONQgAAAMs"]
[Sat May 09 14:23:40.340088 2026] [:error] [pid 9663:tid 9690] [client 20.151.175.120:24116] [client 20.151.175.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "af7S7JcWIu01SCxbjwsr5QAAARg"]
[Sat May 09 14:23:41.578347 2026] [:error] [pid 9833:tid 9841] [client 20.151.175.120:22221] [client 20.151.175.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/wp-login.php"] [unique_id "af7S7SM9JmxIS0KGZUB3RwAAAYM"]
[Sat May 09 14:23:43.880457 2026] [:error] [pid 9187:tid 9272] [client 20.151.175.120:18843] [client 20.151.175.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "af7S7xC7An6gkXsRsaGCpAAAAJM"]
[Sat May 09 14:23:45.504609 2026] [:error] [pid 9760:tid 9774] [client 20.151.175.120:33174] [client 20.151.175.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/about.php"] [unique_id "af7S8WIkCp-C_fh0s7I9zwAAAUg"]
[Sat May 09 14:23:48.038575 2026] [proxy_fcgi:error] [pid 9920:tid 9932] [client 20.151.175.120:31810] AH01071: Got error 'Primary script unknown'
[Sat May 09 14:23:52.317966 2026] [:error] [pid 9920:tid 9945] [client 20.151.175.120:31810] [client 20.151.175.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "af7S-ExitGYhlzgZb5bUzwAAAdc"]
[Sat May 09 14:23:58.482307 2026] [:error] [pid 9920:tid 9928] [client 20.151.175.120:18830] [client 20.151.175.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/index.php"] [unique_id "af7S_kxitGYhlzgZb5bU3AAAAcY"]
[Sat May 09 14:23:58.993684 2026] [:error] [pid 9187:tid 9256] [client 20.151.175.120:32541] [client 20.151.175.120] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/index.php"] [unique_id "af7S_hC7An6gkXsRsaGCvwAAAIM"]
[Sat May 09 16:59:35.733910 2026] [:error] [pid 9187:tid 9267] [client 95.141.213.135:2535] [client 95.141.213.135] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 95.141.213.135, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "af73dxC7An6gkXsRsaG5nQAAAI4"]
[Sat May 09 23:41:03.277133 2026] [:error] [pid 62831:tid 62835] [client 3.140.188.14:65268] [client 3.140.188.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 3.140.188.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "af9Vj-YBNqNhtZ_l7qBFSgAAAAI"]
[Sun May 10 03:55:44.058943 2026] [:error] [pid 62803:tid 62882] [client 104.234.53.169:22097] [client 104.234.53.169] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 104.234.53.169, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "af-RQE5oy4jU7eVtNaXf0wAAAJI"]
[Sun May 10 19:26:24.644373 2026] [:error] [pid 16136:tid 16138] [client 91.73.107.236:25429] [client 91.73.107.236] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 91.73.107.236, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agBrYEOBGdmCMnPX0MfuGgAAAIA"]
[Mon May 11 09:00:28.155763 2026] [:error] [pid 35052:tid 35078] [client 167.172.70.174:62774] [client 167.172.70.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.70.174, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agEqLOHjpNNnFJrMXu2gVAAAAVc"]
[Mon May 11 09:00:28.555633 2026] [:error] [pid 35052:tid 35056] [client 167.172.70.174:62813] [client 167.172.70.174] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 167.172.70.174, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agEqLOHjpNNnFJrMXu2gVgAAAUE"]
[Mon May 11 09:40:12.506518 2026] [:error] [pid 65366:tid 65392] [client 145.132.102.224:30630] [client 145.132.102.224] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 145.132.102.224, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/wp/xmlrpc.php"] [unique_id "agEzfKhVGdYzapDtv-EOpgAAANc"]
[Mon May 11 15:47:45.307009 2026] [:error] [pid 58677:tid 58696] [client 117.212.42.166:62473] [client 117.212.42.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 117.212.42.166, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agGJoRasRhyteIXf1RU_6AAAAIg"]
[Mon May 11 22:04:41.032693 2026] [:error] [pid 58677:tid 58693] [client 176.65.139.168:47810] [client 176.65.139.168] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.local"] [unique_id "agHh-RasRhyteIXf1RV0CAAAAIU"]
[Tue May 12 07:45:25.462130 2026] [:error] [pid 40061:tid 40081] [client 34.154.53.5:50408] [client 34.154.53.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/admin/.env"] [unique_id "agJqFbycIKt8hxHMBYuT4gAAANI"]
[Tue May 12 07:45:25.493411 2026] [:error] [pid 39958:tid 40032] [client 34.154.53.5:50430] [client 34.154.53.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.local"] [unique_id "agJqFeVI9FVDxXB2Xxg1YAAAAI0"]
[Tue May 12 07:45:25.499488 2026] [:error] [pid 39958:tid 40037] [client 34.154.53.5:50418] [client 34.154.53.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "agJqFeVI9FVDxXB2Xxg1YQAAAJI"]
[Tue May 12 07:45:25.764017 2026] [:error] [pid 55559:tid 55641] [client 34.154.53.5:50432] [client 34.154.53.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/api/.env"] [unique_id "agJqFdj0hVMLJAOI_fxcWwAAARQ"]
[Tue May 12 07:45:25.913900 2026] [:error] [pid 55559:tid 55645] [client 34.154.53.5:50470] [client 34.154.53.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.development.local"] [unique_id "agJqFdj0hVMLJAOI_fxcXQAAARg"]
[Tue May 12 07:45:25.923182 2026] [:error] [pid 55559:tid 55640] [client 34.154.53.5:50438] [client 34.154.53.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.docker"] [unique_id "agJqFdj0hVMLJAOI_fxcXgAAARM"]
[Tue May 12 07:45:25.923431 2026] [:error] [pid 55559:tid 55643] [client 34.154.53.5:50454] [client 34.154.53.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.dev.local"] [unique_id "agJqFdj0hVMLJAOI_fxcXwAAARY"]
[Tue May 12 07:45:26.025012 2026] [:error] [pid 55559:tid 55629] [client 34.154.53.5:50480] [client 34.154.53.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/app/.env.local"] [unique_id "agJqFtj0hVMLJAOI_fxcYAAAAQs"]
[Tue May 12 07:45:26.090737 2026] [:error] [pid 55559:tid 55630] [client 34.154.53.5:50488] [client 34.154.53.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/app/.env"] [unique_id "agJqFtj0hVMLJAOI_fxcYQAAAQw"]
[Tue May 12 07:45:26.101603 2026] [:error] [pid 39957:tid 39997] [client 34.154.53.5:50490] [client 34.154.53.5] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.dev"] [unique_id "agJqFuAfHHyq0DBh5BIBPAAAAEU"]
[Tue May 12 10:04:47.440955 2026] [:error] [pid 42143:tid 42163] [client 34.154.110.172:45734] [client 34.154.110.172] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "agKKv0S2WmK92iCO2L2LmwAAAVA"]
[Tue May 12 12:04:42.828523 2026] [:error] [pid 39958:tid 40037] [client 50.121.109.173:56342] [client 50.121.109.173] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 50.121.109.173, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agKm2uVI9FVDxXB2XxhTmwAAAJI"]
[Tue May 12 13:53:58.103406 2026] [:error] [pid 42143:tid 42163] [client 88.130.71.133:60496] [client 88.130.71.133] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 88.130.71.133, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agLAdkS2WmK92iCO2L3TNQAAAVA"]
[Tue May 12 20:06:04.272901 2026] [:error] [pid 39956:tid 39982] [client 20.48.177.41:30597] [client 20.48.177.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.48.177.41, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "agMXrI2K3wZDsNji3MwKvgAAABE"]
[Tue May 12 20:06:06.172287 2026] [:error] [pid 39956:tid 39966] [client 20.48.177.41:30597] [client 20.48.177.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.48.177.41, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agMXro2K3wZDsNji3MwKywAAAAE"]
[Tue May 12 20:06:07.136046 2026] [:error] [pid 39956:tid 39988] [client 20.48.177.41:30597] [client 20.48.177.41] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.48.177.41, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agMXr42K3wZDsNji3MwK0AAAABc"]
[Tue May 12 20:06:11.846526 2026] [:error] [pid 39956:tid 39981] [client 20.48.177.41:30597] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "agMXs42K3wZDsNji3MwK2QAAABA"]
[Tue May 12 20:06:16.312930 2026] [:error] [pid 39957:tid 40009] [client 20.48.177.41:30669] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "agMXuOAfHHyq0DBh5BJ8lwAAAFE"]
[Tue May 12 20:06:17.150273 2026] [:error] [pid 40061:tid 40082] [client 20.48.177.41:30715] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "agMXubycIKt8hxHMBYv8EAAAANM"]
[Tue May 12 20:06:19.106028 2026] [:error] [pid 39958:tid 40042] [client 20.48.177.41:30691] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/admiin.php"] [unique_id "agMXu-VI9FVDxXB2Xxh9WwAAAJc"]
[Tue May 12 20:06:28.742487 2026] [:error] [pid 39958:tid 40038] [client 20.48.177.41:30607] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "agMXxOVI9FVDxXB2Xxh9bgAAAJM"]
[Tue May 12 20:06:36.570903 2026] [:error] [pid 40061:tid 40086] [client 20.48.177.41:30600] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "agMXzLycIKt8hxHMBYv8HQAAANc"]
[Tue May 12 20:06:38.154347 2026] [:error] [pid 21242:tid 21256] [client 20.48.177.41:31642] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "agMXzszeh8JWZob6PnL6IgAAAYo"]
[Tue May 12 20:06:46.413323 2026] [:error] [pid 39957:tid 40011] [client 20.48.177.41:31692] [client 20.48.177.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.48.177.41, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "agMX1uAfHHyq0DBh5BJ8qgAAAFM"]
[Tue May 12 20:06:48.199753 2026] [:error] [pid 39957:tid 40016] [client 20.48.177.41:31692] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "agMX2OAfHHyq0DBh5BJ8rgAAAFg"]
[Tue May 12 20:06:54.281758 2026] [:error] [pid 21242:tid 21265] [client 20.48.177.41:31666] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/admin.php"] [unique_id "agMX3szeh8JWZob6PnL6MwAAAZM"]
[Tue May 12 20:06:57.962028 2026] [:error] [pid 42143:tid 42164] [client 20.48.177.41:31700] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "agMX4US2WmK92iCO2L0bfQAAAVE"]
[Tue May 12 20:07:04.357506 2026] [:error] [pid 39958:tid 40036] [client 20.48.177.41:31738] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "agMX6OVI9FVDxXB2Xxh9eQAAAJE"]
[Tue May 12 20:07:07.234918 2026] [:error] [pid 39957:tid 39994] [client 20.48.177.41:31709] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "agMX6-AfHHyq0DBh5BJ8vQAAAEI"]
[Tue May 12 20:07:09.286672 2026] [:error] [pid 39957:tid 39996] [client 20.48.177.41:31741] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "agMX7eAfHHyq0DBh5BJ8wAAAAEQ"]
[Tue May 12 20:07:12.115368 2026] [:error] [pid 39956:tid 39984] [client 20.48.177.41:31663] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "agMX8I2K3wZDsNji3MwK4QAAABM"]
[Tue May 12 20:07:13.967598 2026] [:error] [pid 40061:tid 40077] [client 20.48.177.41:31699] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "agMX8bycIKt8hxHMBYv8KAAAAM4"]
[Tue May 12 20:07:16.815546 2026] [:error] [pid 39957:tid 40004] [client 20.48.177.41:31649] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "agMX9OAfHHyq0DBh5BJ8yAAAAEw"]
[Tue May 12 20:07:19.495968 2026] [:error] [pid 40061:tid 40073] [client 20.48.177.41:30698] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/lv.php"] [unique_id "agMX97ycIKt8hxHMBYv8KwAAAMo"]
[Tue May 12 20:07:29.285624 2026] [:error] [pid 40061:tid 40073] [client 20.48.177.41:31620] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "agMYAbycIKt8hxHMBYv8PwAAAMo"]
[Tue May 12 20:07:30.416875 2026] [:error] [pid 55559:tid 55633] [client 20.48.177.41:31697] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "agMYAtj0hVMLJAOI_fy0qwAAAQ4"]
[Tue May 12 20:07:32.979728 2026] [proxy_fcgi:error] [pid 39958:tid 40024] [client 20.48.177.41:31628] AH01071: Got error 'Primary script unknown'
[Tue May 12 20:07:33.191193 2026] [:error] [pid 39958:tid 40029] [client 20.48.177.41:31628] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "agMYBeVI9FVDxXB2Xxh9hAAAAIo"]
[Tue May 12 20:07:34.730561 2026] [proxy_fcgi:error] [pid 39958:tid 40033] [client 20.48.177.41:31665] AH01071: Got error 'Primary script unknown'
[Tue May 12 20:07:36.637475 2026] [:error] [pid 39958:tid 40037] [client 20.48.177.41:31665] [client 20.48.177.41] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.48.177.41, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "agMYCOVI9FVDxXB2Xxh9igAAAJI"]
[Tue May 12 20:07:39.809282 2026] [:error] [pid 39958:tid 40040] [client 20.48.177.41:31665] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "agMYC-VI9FVDxXB2Xxh9kwAAAJU"]
[Tue May 12 20:07:44.834179 2026] [:error] [pid 42143:tid 42158] [client 20.48.177.41:31720] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "agMYEES2WmK92iCO2L0bjQAAAUs"]
[Tue May 12 20:07:47.760779 2026] [:error] [pid 21242:tid 21270] [client 20.48.177.41:31722] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "agMYE8zeh8JWZob6PnL6ZAAAAZg"]
[Tue May 12 20:07:48.356190 2026] [:error] [pid 21242:tid 21248] [client 20.48.177.41:31670] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "agMYFMzeh8JWZob6PnL6ZQAAAYI"]
[Tue May 12 20:07:54.239895 2026] [:error] [pid 39957:tid 40010] [client 20.48.177.41:31707] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "agMYGuAfHHyq0DBh5BJ81gAAAFI"]
[Tue May 12 20:07:54.893975 2026] [:error] [pid 21242:tid 21250] [client 20.48.177.41:31694] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "agMYGszeh8JWZob6PnL6cAAAAYQ"]
[Tue May 12 20:07:55.632693 2026] [:error] [pid 40061:tid 40065] [client 20.48.177.41:31647] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "agMYG7ycIKt8hxHMBYv8QAAAAMI"]
[Tue May 12 20:07:59.211635 2026] [:error] [pid 39957:tid 39999] [client 20.48.177.41:31701] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "agMYH-AfHHyq0DBh5BJ84AAAAEc"]
[Tue May 12 20:08:04.003899 2026] [:error] [pid 42143:tid 42163] [client 20.48.177.41:31736] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/php-compat/index.php"] [unique_id "agMYJES2WmK92iCO2L0blAAAAVA"]
[Tue May 12 20:08:06.809967 2026] [:error] [pid 42143:tid 42160] [client 20.48.177.41:31731] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/xwx1.php"] [unique_id "agMYJkS2WmK92iCO2L0bmQAAAU0"]
[Tue May 12 20:08:07.857584 2026] [:error] [pid 39957:tid 39995] [client 20.48.177.41:31674] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "agMYJ-AfHHyq0DBh5BJ85QAAAEM"]
[Tue May 12 20:08:08.465385 2026] [:error] [pid 55559:tid 55621] [client 20.48.177.41:31633] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "agMYKNj0hVMLJAOI_fy0zQAAAQM"]
[Tue May 12 20:08:10.240206 2026] [:error] [pid 42143:tid 42158] [client 20.48.177.41:31711] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "agMYKkS2WmK92iCO2L0bngAAAUs"]
[Tue May 12 20:08:13.340231 2026] [:error] [pid 21242:tid 21255] [client 20.48.177.41:31672] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css.php"] [unique_id "agMYLczeh8JWZob6PnL6fgAAAYk"]
[Tue May 12 20:08:16.231748 2026] [:error] [pid 39957:tid 39996] [client 20.48.177.41:31705] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "agMYMOAfHHyq0DBh5BJ87gAAAEQ"]
[Tue May 12 20:08:17.263189 2026] [:error] [pid 42143:tid 42168] [client 20.48.177.41:31661] [client 20.48.177.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "agMYMUS2WmK92iCO2L0bogAAAVU"]
[Wed May 13 02:52:02.187304 2026] [:error] [pid 21242:tid 21252] [client 91.92.241.188:52694] [client 91.92.241.188] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "agN20szeh8JWZob6PnJcSQAAAYY"]
[Wed May 13 06:57:36.384708 2026] [:error] [pid 23780:tid 23806] [client 102.223.33.208:56488] [client 102.223.33.208] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 102.223.33.208, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agOwYHXgOibPjrXgeTBE0gAAAAw"]
[Wed May 13 09:17:40.895434 2026] [:error] [pid 3259:tid 3264] [client 65.111.26.60:40659] [client 65.111.26.60] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "agPRNOWJB4YwcPVLeAqwRgAAAQM"]
[Wed May 13 09:17:45.672978 2026] [:error] [pid 3259:tid 3280] [client 217.181.92.59:49931] [client 217.181.92.59] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.svn/wc.db"] [unique_id "agPROeWJB4YwcPVLeAqwUAAAARM"]
[Wed May 13 11:29:49.910996 2026] [:error] [pid 23782:tid 23842] [client 216.26.251.4:20021] [client 216.26.251.4] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.svn/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.svn/wc.db"] [unique_id "agPwLSBrKFYHXUGnR-qmwwAAAFU"]
[Wed May 13 13:10:28.350595 2026] [:error] [pid 27332:tid 27337] [client 46.105.44.27:40716] [client 46.105.44.27] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "agQHxI6Y5F_V9bmyC4aHMwAAAUM"]
[Wed May 13 18:39:28.339246 2026] [:error] [pid 55679:tid 55700] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.159, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agRU4KvvigowSOGkp44XXwAAAhM"]
[Wed May 13 18:39:45.114490 2026] [:error] [pid 55679:tid 55704] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.paramountestate.com.au"] [uri "/wp-json/wp/v2/users"] [unique_id "agRU8avvigowSOGkp44XkAAAAhc"]
[Wed May 13 18:39:46.046567 2026] [:error] [pid 55679:tid 55703] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||www.paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "www.paramountestate.com.au"] [uri "/index.php/wp-json/wp/v2/users"] [unique_id "agRU8qvvigowSOGkp44XkgAAAhY"]
[Wed May 13 18:39:50.051227 2026] [:error] [pid 55679:tid 55692] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.159, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agRU9qvvigowSOGkp44XmQAAAgs"]
[Wed May 13 18:39:50.668050 2026] [:error] [pid 55679:tid 55681] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.159, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agRU9qvvigowSOGkp44XmgAAAgA"], referer: https://www.paramountestate.com.au/wp-login.php
[Wed May 13 18:39:50.983609 2026] [:error] [pid 55679:tid 55688] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.159, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agRU9qvvigowSOGkp44XmwAAAgc"], referer: https://www.paramountestate.com.au/wp-login.php
[Wed May 13 18:39:51.299168 2026] [:error] [pid 55679:tid 55693] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.159, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agRU96vvigowSOGkp44XnAAAAgw"], referer: https://www.paramountestate.com.au/wp-login.php
[Wed May 13 18:39:51.613158 2026] [:error] [pid 55679:tid 55690] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.159, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agRU96vvigowSOGkp44XnQAAAgk"]
[Wed May 13 18:39:52.229614 2026] [:error] [pid 55679:tid 55684] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.159, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agRU-KvvigowSOGkp44XngAAAgM"], referer: https://www.paramountestate.com.au/wp-login.php
[Wed May 13 18:39:52.543140 2026] [:error] [pid 55679:tid 55685] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.159, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agRU-KvvigowSOGkp44XnwAAAgQ"], referer: https://www.paramountestate.com.au/wp-login.php
[Wed May 13 18:39:52.856805 2026] [:error] [pid 55679:tid 55687] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.159, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agRU-KvvigowSOGkp44XoAAAAgY"], referer: https://www.paramountestate.com.au/wp-login.php
[Wed May 13 18:39:53.169505 2026] [:error] [pid 55679:tid 55695] [client 91.224.92.159:51510] [client 91.224.92.159] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 91.224.92.159, incrementing brute counter"] [hostname "www.paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agRU-avvigowSOGkp44XoQAAAg4"]
[Thu May 14 02:02:26.664894 2026] [:error] [pid 12426:tid 12432] [client 88.151.33.33:43030] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "agS8srPw24RslX3LIcZsQwAAAMQ"]
[Thu May 14 02:02:26.797218 2026] [:error] [pid 17873:tid 17887] [client 88.151.33.33:43148] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production"] [unique_id "agS8svEqBQQrkyEyu_ox5gAAAQw"]
[Thu May 14 02:02:26.799033 2026] [:error] [pid 17873:tid 17889] [client 88.151.33.33:43178] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.bak"] [unique_id "agS8svEqBQQrkyEyu_ox5wAAAQ4"]
[Thu May 14 02:02:26.799475 2026] [:error] [pid 12426:tid 12443] [client 88.151.33.33:43036] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.example"] [unique_id "agS8srPw24RslX3LIcZsRQAAAM8"]
[Thu May 14 02:02:26.800574 2026] [:error] [pid 17873:tid 17875] [client 88.151.33.33:43096] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.local"] [unique_id "agS8svEqBQQrkyEyu_ox6AAAAQA"]
[Thu May 14 02:02:26.801089 2026] [:error] [pid 12338:tid 12387] [client 88.151.33.33:43232] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/api/.env"] [unique_id "agS8ssUJ87l42ffPr4wx7wAAAFI"]
[Thu May 14 02:02:26.810454 2026] [:error] [pid 12338:tid 12369] [client 88.151.33.33:43206] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.staging"] [unique_id "agS8ssUJ87l42ffPr4wx8AAAAEA"]
[Thu May 14 02:02:26.810991 2026] [:error] [pid 12338:tid 12391] [client 88.151.33.33:43150] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.backup"] [unique_id "agS8ssUJ87l42ffPr4wx8gAAAFY"]
[Thu May 14 02:02:26.811401 2026] [:error] [pid 12338:tid 12379] [client 88.151.33.33:43142] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/admin/.env"] [unique_id "agS8ssUJ87l42ffPr4wx8wAAAEo"]
[Thu May 14 02:02:28.869542 2026] [:error] [pid 12337:tid 12353] [client 88.151.33.33:43050] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com.au|F|2"] [data ".log"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com.au"] [uri "/storage/logs/laravel.log"] [unique_id "agS8tA9W0E4_X4qzYUGEcgAAAAs"]
[Thu May 14 02:02:28.870407 2026] [:error] [pid 12338:tid 12371] [client 88.151.33.33:43192] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.old"] [unique_id "agS8tMUJ87l42ffPr4wx9AAAAEI"]
[Thu May 14 02:02:28.878339 2026] [:error] [pid 12337:tid 12347] [client 88.151.33.33:43256] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/public/.env"] [unique_id "agS8tA9W0E4_X4qzYUGEcwAAAAU"]
[Thu May 14 02:02:28.882742 2026] [:error] [pid 12338:tid 12392] [client 88.151.33.33:43250] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/app/.env"] [unique_id "agS8tMUJ87l42ffPr4wx9wAAAFc"]
[Thu May 14 02:02:28.882742 2026] [:error] [pid 12338:tid 12390] [client 88.151.33.33:43152] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.development"] [unique_id "agS8tMUJ87l42ffPr4wx-gAAAFU"]
[Thu May 14 02:02:28.882862 2026] [:error] [pid 12338:tid 12378] [client 88.151.33.33:43218] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.test"] [unique_id "agS8tMUJ87l42ffPr4wx-QAAAEk"]
[Thu May 14 02:02:28.883463 2026] [:error] [pid 12338:tid 12392] [client 88.151.33.33:43242] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/backend/.env"] [unique_id "agS8tMUJ87l42ffPr4wx-wAAAFc"]
[Thu May 14 02:02:28.884580 2026] [:error] [pid 12338:tid 12373] [client 88.151.33.33:43140] [client 88.151.33.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "agS8tMUJ87l42ffPr4wx_wAAAEQ"]
[Thu May 14 16:33:46.075919 2026] [:error] [pid 11581:tid 11620] [client 185.220.175.199:41750] [client 185.220.175.199] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.env"] [unique_id "agWI6v0vF48FbzpvQMXTiwAAABc"]
[Fri May 15 03:08:58.563074 2026] [:error] [pid 11588:tid 11675] [client 34.65.236.35:58640] [client 34.65.236.35] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "agYdytUr21rOixkeGKbgIAAAAJc"]
[Fri May 15 03:19:53.215573 2026] [:error] [pid 47673:tid 47699] [client 34.118.187.183:51120] [client 34.118.187.183] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "agYgWfCGe4cIn3sh5k1IPQAAAVg"]
[Fri May 15 03:39:40.893862 2026] [:error] [pid 63399:tid 63424] [client 34.162.37.253:42146] [client 34.162.37.253] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "agYk_MYtMho_2JABGpOFnwAAAAM"]
[Fri May 15 03:43:23.652569 2026] [:error] [pid 2406:tid 2444] [client 35.237.35.196:53068] [client 35.237.35.196] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "agYl23-5IhrEbhf-k3EXMgAAAAQ"]
[Fri May 15 10:12:50.247002 2026] [:error] [pid 51234:tid 51250] [client 38.154.90.11:55270] [client 38.154.90.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/robots.txt"] [unique_id "agaBIt72N9CbeiqcqgPZ4gAAAU4"]
[Fri May 15 10:12:50.258702 2026] [:error] [pid 1189:tid 1245] [client 38.154.90.11:35675] [client 38.154.90.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/sitemap.xml"] [unique_id "agaBIge36qIGegR4kcmE7AAAAFQ"]
[Fri May 15 10:12:50.267621 2026] [:error] [pid 1189:tid 1247] [client 38.154.90.11:41143] [client 38.154.90.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "agaBIge36qIGegR4kcmE7QAAAFY"]
[Fri May 15 10:12:51.594380 2026] [:error] [pid 1188:tid 1207] [client 38.154.90.11:34763] [client 38.154.90.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/robots.txt"] [unique_id "agaBI9Y68iW8yuNkNzPyKAAAAAo"]
[Fri May 15 10:12:51.606422 2026] [:error] [pid 1188:tid 1203] [client 38.154.90.11:40833] [client 38.154.90.11] ModSecurity: Access denied with code 403 (phase 2). Pattern match "\\\\b(close|keep-alive),[\\\\t\\\\n\\\\r ]{0,1}(close|keep-alive)\\\\b" at REQUEST_HEADERS:Connection. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "70"] [id "210350"] [rev "1"] [msg "COMODO WAF: Multiple/Conflicting Connection Header Data Found||paramountestate.com.au|F|4"] [data "keep-alive, close"] [severity "WARNING"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/sitemap.xml"] [unique_id "agaBI9Y68iW8yuNkNzPyKQAAAAY"]
[Fri May 15 16:00:00.323300 2026] [:error] [pid 9305:tid 9345] [client 34.104.158.149:50780] [client 34.104.158.149] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "agbSgN5FZyBmdCM8GsF_RwAAAEc"]
[Fri May 15 16:25:36.151893 2026] [:error] [pid 30272:tid 30282] [client 34.129.123.68:34910] [client 34.129.123.68] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "agbYgHvc_jSFaQ_7_we84QAAAYg"]
[Fri May 15 21:39:26.542201 2026] [:error] [pid 30272:tid 30292] [client 189.62.10.13:49890] [client 189.62.10.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 189.62.10.13, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agciDnvc_jSFaQ_7_wf6twAAAZI"]
[Sat May 16 01:59:21.289614 2026] [:error] [pid 30240:tid 30245] [client 158.173.67.48:44913] [client 158.173.67.48] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.48, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agde-a8ckHvaA6bpewuNjgAAAUM"]
[Sat May 16 01:59:26.397599 2026] [:error] [pid 9305:tid 9345] [client 158.173.67.166:46529] [client 158.173.67.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.166, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agde_t5FZyBmdCM8GsGkxQAAAEc"]
[Sat May 16 01:59:29.608780 2026] [:error] [pid 9305:tid 9345] [client 158.173.67.166:46529] [client 158.173.67.166] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.173.67.166, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agdfAd5FZyBmdCM8GsGkywAAAEc"]
[Sat May 16 02:26:20.604822 2026] [:error] [pid 59522:tid 59568] [client 20.198.127.163:2825] [client 20.198.127.163] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.198.127.163, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agdlTIKyKAkpeBAoLCZZrAAAA80"]
[Sat May 16 02:26:21.946334 2026] [:error] [pid 59522:tid 59557] [client 20.198.127.163:2825] [client 20.198.127.163] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.198.127.163, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agdlTYKyKAkpeBAoLCZZtwAAA8I"]
[Sat May 16 02:26:23.688555 2026] [:error] [pid 59522:tid 59560] [client 20.198.127.163:2825] [client 20.198.127.163] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agdlT4KyKAkpeBAoLCZZxgAAA8U"]
[Sat May 16 03:21:56.359726 2026] [:error] [pid 20873:tid 20961] [client 20.219.50.182:5124] [client 20.219.50.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.50.182, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agdyVEofXuNFEgwEBPr9PAAAAI4"]
[Sat May 16 03:21:57.664851 2026] [:error] [pid 20873:tid 20961] [client 20.219.50.182:5124] [client 20.219.50.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.219.50.182, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agdyVUofXuNFEgwEBPr9SAAAAI4"]
[Sat May 16 03:21:59.394740 2026] [:error] [pid 20873:tid 20949] [client 20.219.50.182:5124] [client 20.219.50.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agdyV0ofXuNFEgwEBPr9WgAAAII"]
[Sat May 16 07:06:15.130847 2026] [:error] [pid 24869:tid 24921] [client 20.48.155.67:4414] [client 20.48.155.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "agem5-xo3FMprMltYl4G7wAAAE0"]
[Sat May 16 07:06:30.353602 2026] [proxy_fcgi:error] [pid 24867:tid 24885] [client 20.48.155.67:10069] AH01071: Got error 'Primary script unknown'
[Sat May 16 07:06:30.686894 2026] [:error] [pid 24867:tid 24891] [client 20.48.155.67:10069] [client 20.48.155.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/shortcode/index.php"] [unique_id "agem9iDgFLCgyKq-zmbyGQAAAAo"]
[Sat May 16 07:06:35.966954 2026] [:error] [pid 24979:tid 24986] [client 20.48.155.67:14933] [client 20.48.155.67] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.48.155.67, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agem-7vSFUQiwLaOL2o37QAAAMU"]
[Sat May 16 07:06:46.920843 2026] [:error] [pid 24979:tid 24999] [client 20.48.155.67:14933] [client 20.48.155.67] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.48.155.67, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agenBrvSFUQiwLaOL2o4MwAAANI"]
[Sat May 16 07:06:50.705090 2026] [:error] [pid 24979:tid 25004] [client 20.48.155.67:14933] [client 20.48.155.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/about.php"] [unique_id "agenCrvSFUQiwLaOL2o4OwAAANc"]
[Sat May 16 07:06:55.274447 2026] [:error] [pid 24874:tid 24937] [client 20.48.155.67:48484] [client 20.48.155.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "agenD8iii6x3XidYGHGlTwAAAII"]
[Sat May 16 07:06:58.622777 2026] [:error] [pid 24867:tid 24882] [client 20.48.155.67:17404] [client 20.48.155.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/index.php"] [unique_id "agenEiDgFLCgyKq-zmbyPwAAAAE"]
[Sat May 16 07:07:00.920757 2026] [:error] [pid 24867:tid 24891] [client 20.48.155.67:17345] [client 20.48.155.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/autoload_classmap.php"] [unique_id "agenFCDgFLCgyKq-zmbySAAAAAo"]
[Sat May 16 07:07:01.550445 2026] [:error] [pid 24979:tid 24994] [client 20.48.155.67:16734] [client 20.48.155.67] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/admin.php"] [unique_id "agenFbvSFUQiwLaOL2o4UQAAAM0"]
[Sat May 16 09:48:00.730662 2026] [:error] [pid 24874:tid 24948] [client 37.139.53.198:40611] [client 37.139.53.198] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "paramountestate.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "agfM0Miii6x3XidYGHHAawAAAI0"]
[Sat May 16 09:48:03.983617 2026] [:error] [pid 24874:tid 24957] [client 103.74.77.102:41903] [client 103.74.77.102] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "paramountestate.com.au"] [uri "/wp-json/wp/v2/users/"] [unique_id "agfM08iii6x3XidYGHHAdQAAAJY"]
[Sat May 16 16:30:36.669960 2026] [:error] [pid 24867:tid 24894] [client 176.65.139.239:59652] [client 176.65.139.239] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aggrLCDgFLCgyKq-zmYXwQAAAA0"]
[Sun May 17 02:48:21.042434 2026] [:error] [pid 61463:tid 61481] [client 103.215.75.221:11562] [client 103.215.75.221] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||paramountestate.com.au|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "agi79TXdL1WU7nYXPmQIYAAAAdA"]
[Sun May 17 02:48:21.042571 2026] [:error] [pid 61463:tid 61481] [client 103.215.75.221:11562] [client 103.215.75.221] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "agi79TXdL1WU7nYXPmQIYAAAAdA"]
[Sun May 17 02:48:21.239315 2026] [:error] [pid 61463:tid 61471] [client 103.215.75.221:11562] [client 103.215.75.221] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||paramountestate.com.au|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "agi79TXdL1WU7nYXPmQIYQAAAcY"]
[Sun May 17 02:48:21.239434 2026] [:error] [pid 61463:tid 61471] [client 103.215.75.221:11562] [client 103.215.75.221] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "agi79TXdL1WU7nYXPmQIYQAAAcY"]
[Sun May 17 03:00:37.458147 2026] [:error] [pid 24979:tid 24982] [client 92.118.39.29:59872] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "agi-1bvSFUQiwLaOL2rMEQAAAME"]
[Sun May 17 04:09:25.416848 2026] [:error] [pid 36652:tid 36674] [client 34.74.25.123:60278] [client 34.74.25.123] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "agjO9TZrzQadnZADvj_0dgAAARQ"]
[Sun May 17 06:43:17.420551 2026] [:error] [pid 59166:tid 59185] [client 103.253.27.67:56951] [client 103.253.27.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "agjzBU_puQ1I47_0UrizNwAAANE"]
[Sun May 17 06:43:18.762186 2026] [:error] [pid 36652:tid 36669] [client 103.253.27.67:56963] [client 103.253.27.67] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.vscode/sftp-config.json"] [unique_id "agjzBjZrzQadnZADvj8XTAAAAQ8"]
[Sun May 17 11:57:42.881373 2026] [:error] [pid 17234:tid 17242] [client 20.219.31.81:2517] [client 20.219.31.81] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.31.81, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agk8ttJ4QOrYRCeDR2gu1wAAAUY"]
[Sun May 17 11:57:44.173680 2026] [:error] [pid 17234:tid 17256] [client 20.219.31.81:2517] [client 20.219.31.81] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.219.31.81, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agk8uNJ4QOrYRCeDR2gu5AAAAVQ"]
[Sun May 17 11:57:45.936404 2026] [:error] [pid 17234:tid 17250] [client 20.219.31.81:2517] [client 20.219.31.81] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agk8udJ4QOrYRCeDR2gu8gAAAU4"]
[Sun May 17 13:03:23.221909 2026] [:error] [pid 36652:tid 36655] [client 192.96.159.129:63797] [client 192.96.159.129] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "aglMGzZrzQadnZADvj9JjwAAAQE"]
[Sun May 17 13:41:43.065482 2026] [:error] [pid 11079:tid 11122] [client 103.215.75.221:18422] [client 103.215.75.221] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||paramountestate.com.au|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aglVF2eR3-DrxhvUqxGjswAAAlI"]
[Sun May 17 13:41:43.065581 2026] [:error] [pid 11079:tid 11122] [client 103.215.75.221:18422] [client 103.215.75.221] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aglVF2eR3-DrxhvUqxGjswAAAlI"]
[Sun May 17 13:41:43.430297 2026] [:error] [pid 11079:tid 11109] [client 103.215.75.221:18422] [client 103.215.75.221] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||paramountestate.com.au|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aglVF2eR3-DrxhvUqxGjtAAAAkg"]
[Sun May 17 13:41:43.430403 2026] [:error] [pid 11079:tid 11109] [client 103.215.75.221:18422] [client 103.215.75.221] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "aglVF2eR3-DrxhvUqxGjtAAAAkg"]
[Sun May 17 13:46:47.056101 2026] [:error] [pid 59062:tid 59123] [client 92.118.39.29:51216] [client 92.118.39.29] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aglWRz4V9GkVWmCFmGbknQAAAIA"]
[Sun May 17 14:27:13.507911 2026] [:error] [pid 17234:tid 17258] [client 104.23.239.33:12261] [client 104.23.239.33] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "aglfwdJ4QOrYRCeDR2hDUwAAAVY"]
[Sun May 17 15:43:28.024137 2026] [:error] [pid 17234:tid 17254] [client 20.204.3.108:1049] [client 20.204.3.108] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.204.3.108, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "aglxoNJ4QOrYRCeDR2hI3QAAAVI"]
[Sun May 17 15:43:29.420448 2026] [:error] [pid 17234:tid 17246] [client 20.204.3.108:1049] [client 20.204.3.108] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.204.3.108, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "aglxodJ4QOrYRCeDR2hI5gAAAUo"]
[Sun May 17 15:43:31.236859 2026] [:error] [pid 17234:tid 17238] [client 20.204.3.108:1049] [client 20.204.3.108] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "aglxo9J4QOrYRCeDR2hI8gAAAUI"]
[Sun May 17 21:49:22.578347 2026] [:error] [pid 10784:tid 10824] [client 45.129.32.13:46786] [client 45.129.32.13] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 45.129.32.13, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agnHYmBWRlKsFkSZGxBQawAAAZc"]
[Mon May 18 03:08:36.213890 2026] [:error] [pid 17234:tid 17253] [client 20.219.0.106:1901] [client 20.219.0.106] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.219.0.106, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agoSNNJ4QOrYRCeDR2h1JgAAAVE"]
[Mon May 18 03:08:37.539559 2026] [:error] [pid 17234:tid 17240] [client 20.219.0.106:1901] [client 20.219.0.106] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.219.0.106, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agoSNdJ4QOrYRCeDR2h1LwAAAUQ"]
[Mon May 18 03:08:40.669032 2026] [:error] [pid 17234:tid 17252] [client 20.219.0.106:1901] [client 20.219.0.106] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agoSONJ4QOrYRCeDR2h1OwAAAVA"]
[Mon May 18 21:00:10.337823 2026] [:error] [pid 36492:tid 36531] [client 35.253.183.225:57222] [client 35.253.183.225] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "agsNWmCVlogrkn9m2w7xGwAAAAk"]
[Tue May 19 02:41:32.587352 2026] [:error] [pid 44087:tid 44106] [client 20.204.82.247:5678] [client 20.204.82.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "agtdXG5HPHbH9GK7l6wS7AAAAdE"]
[Tue May 19 02:41:33.191016 2026] [:error] [pid 36492:tid 36526] [client 20.204.82.247:5637] [client 20.204.82.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "agtdXWCVlogrkn9m2w4wqQAAAAQ"]
[Tue May 19 02:41:33.795162 2026] [:error] [pid 36579:tid 36597] [client 20.204.82.247:5306] [client 20.204.82.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "agtdXV-aoZxBfgL5vDy7ZwAAAE8"]
[Tue May 19 02:41:34.394196 2026] [:error] [pid 44010:tid 44019] [client 20.204.82.247:5651] [client 20.204.82.247] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "agtdXjcFUuogD3-74-aQbwAAAMc"]
[Tue May 19 04:49:49.538831 2026] [:error] [pid 38697:tid 38736] [client 103.65.237.216:55759] [client 103.65.237.216] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/sftp-config.json" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/sftp-config.json"] [unique_id "agt7baXP9pP6Kgt-msSY4AAAABU"]
[Tue May 19 04:49:49.781576 2026] [:error] [pid 38697:tid 38735] [client 103.65.237.216:55787] [client 103.65.237.216] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.vscode/sftp.json"] [unique_id "agt7baXP9pP6Kgt-msSY4gAAABQ"]
[Tue May 19 07:25:39.855741 2026] [:error] [pid 38697:tid 38717] [client 4.228.184.113:50829] [client 4.228.184.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "aguf86XP9pP6Kgt-msS85AAAAAI"]
[Tue May 19 07:26:33.201400 2026] [:error] [pid 38697:tid 38737] [client 4.228.184.113:50848] [client 4.228.184.113] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "agugKaXP9pP6Kgt-msS9mwAAABY"]
[Tue May 19 14:59:32.417625 2026] [:error] [pid 41573:tid 41590] [client 202.155.8.152:53110] [client 202.155.8.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/burst-statistics/readme.txt"] [unique_id "agwKVC1A2bd6JDSW9RZjwgAAAQ8"]
[Tue May 19 14:59:36.334315 2026] [:error] [pid 46815:tid 46835] [client 202.155.8.152:53464] [client 202.155.8.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wordpress/wp-content/plugins/burst-statistics/readme.txt"] [unique_id "agwKWCPnRhJOmA06LgpX7gAAAVI"]
[Tue May 19 14:59:40.717976 2026] [:error] [pid 38814:tid 38816] [client 202.155.8.152:54503] [client 202.155.8.152] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp/wp-content/plugins/burst-statistics/readme.txt"] [unique_id "agwKXAvkKuBwP0epzWd_rgAAAMA"]
[Tue May 19 18:57:17.487053 2026] [:error] [pid 29823:tid 29840] [client 103.244.178.38:61588] [client 103.244.178.38] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.244.178.38, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agxCDWO09C0nAz8vRk41BwAAAcU"]
[Tue May 19 19:19:00.701868 2026] [:error] [pid 46815:tid 46821] [client 20.198.90.170:4300] [client 20.198.90.170] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.198.90.170, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "agxHJCPnRhJOmA06LgpvBgAAAUQ"]
[Tue May 19 19:19:02.043885 2026] [:error] [pid 46815:tid 46828] [client 20.198.90.170:4300] [client 20.198.90.170] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.198.90.170, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "agxHJiPnRhJOmA06LgpvDwAAAUs"]
[Tue May 19 19:19:03.851005 2026] [:error] [pid 46815:tid 46821] [client 20.198.90.170:4300] [client 20.198.90.170] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "agxHJyPnRhJOmA06LgpvGwAAAUQ"]
[Wed May 20 14:34:00.446729 2026] [:error] [pid 41277:tid 41298] [client 34.46.57.55:58371] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ag1V2LTTCltJmboB5ufmwwAAABA"]
[Wed May 20 14:34:00.842109 2026] [:error] [pid 7664:tid 7688] [client 34.46.57.55:63956] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ag1V2HZ8s7o3eiqT2kvOvgAAAVU"]
[Wed May 20 14:34:01.228711 2026] [:error] [pid 41277:tid 41305] [client 34.46.57.55:58474] [client 34.46.57.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag1V2bTTCltJmboB5ufm1gAAABc"]
[Wed May 20 16:49:45.242437 2026] [:error] [pid 7664:tid 7668] [client 146.120.212.154:60766] [client 146.120.212.154] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 146.120.212.154, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ag11qXZ8s7o3eiqT2kvfcgAAAUE"]
[Wed May 20 21:07:38.449875 2026] [:error] [pid 44059:tid 44068] [client 195.178.110.105:39666] [client 195.178.110.105] ModSecurity: Warning. Match of "eq 0" against "REQBODY_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "27"] [id "210230"] [rev "2"] [msg "COMODO WAF: The request body could not be parsed. Possibility of an impedance mismatch attack. This is not a false positive.||paramountestate.com.au|F|2"] [data "Multipart parsing error: Multipart: No boundaries found in payload."] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ag2yGRfFs-oSOOcyjywqYQAAAQc"]
[Wed May 20 21:07:38.449986 2026] [:error] [pid 44059:tid 44068] [client 195.178.110.105:39666] [client 195.178.110.105] ModSecurity: Access denied with code 403 (phase 2). Match of "eq 0" against "MULTIPART_STRICT_ERROR" required. [file "/usr/local/apache/modsecurity-cwaf/rules/12_HTTP_Protocol.conf"] [line "30"] [id "210240"] [rev "4"] [msg "COMODO WAF: Multipart request body failed strict validation: PE 1, BQ 0, BW 0, DB 1, DA 0, HF 0, LF 0, SM , IQ 0, IH 0, FLE 0||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "Protocol"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ag2yGRfFs-oSOOcyjywqYQAAAQc"]
[Thu May 21 03:51:14.868939 2026] [:error] [pid 46212:tid 46237] [client 135.119.26.13:15327] [client 135.119.26.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "ag4Qso4OmmRNcziuKmLKsAAAAMk"]
[Thu May 21 03:51:47.853355 2026] [:error] [pid 46212:tid 46234] [client 135.119.26.13:15306] [client 135.119.26.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "ag4Q044OmmRNcziuKmLLJAAAAMY"]
[Thu May 21 15:20:43.141727 2026] [:error] [pid 9189:tid 9237] [client 112.206.243.5:35509] [client 112.206.243.5] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 112.206.243.5, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ag6yS5vTDh1NbYizKVx_RAAAAhI"]
[Thu May 21 23:24:10.005093 2026] [:error] [pid 49884:tid 49964] [client 34.150.255.112:62938] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ag8jmq5MPpsTNNHWS6gXTAAAAJE"]
[Thu May 21 23:24:10.437839 2026] [:error] [pid 49884:tid 49962] [client 34.150.255.112:65318] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ag8jmq5MPpsTNNHWS6gXtwAAAI8"]
[Thu May 21 23:24:10.892595 2026] [:error] [pid 9188:tid 9193] [client 34.150.255.112:60919] [client 34.150.255.112] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/wlwmanifest.xml"] [unique_id "ag8jmrGYm6q5dNSUvA__EQAAAcE"]
[Fri May 22 01:47:50.771406 2026] [:error] [pid 49982:tid 49995] [client 2.57.168.12:51113] [client 2.57.168.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.12, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9FRmFwIDa5Tf8O4bY4DwAAAMs"], referer: https://www.google.com/
[Fri May 22 01:48:58.125643 2026] [:error] [pid 51613:tid 51638] [client 2.57.168.27:57485] [client 2.57.168.27] ModSecurity: Access denied with code 403 (phase 2). Operator EQ matched 0 at REQUEST_COOKIES_NAMES. [file "/usr/local/apache/modsecurity-cwaf/rules/26_Apps_WordPress.conf"] [line "155"] [id "225170"] [rev "3"] [msg "COMODO WAF: Sensitive Information Disclosure Vulnerability in WordPress 4.7 (CVE-2017-5487)||paramountestate.com.au|F|2"] [severity "CRITICAL"] [tag "CWAF"] [tag "WordPress"] [hostname "paramountestate.com.au"] [uri "/wp-json/wp/v2/users"] [unique_id "ag9FimbP0MDvqrVnweofKAAAARc"], referer: https://www.google.com/search?q=wordpress
[Fri May 22 01:49:34.407018 2026] [:error] [pid 49877:tid 49908] [client 2.57.168.10:31081] [client 2.57.168.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.10, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9FrhgN4MeSe4kIL9BXsQAAABQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 01:51:27.028912 2026] [:error] [pid 9188:tid 9208] [client 2.57.168.15:41939] [client 2.57.168.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.15, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9GH7GYm6q5dNSUvA8QaAAAAdA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 01:53:04.382647 2026] [:error] [pid 49884:tid 49961] [client 2.57.168.25:25171] [client 2.57.168.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.25, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9GgK5MPpsTNNHWS6gygQAAAI4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 01:53:49.357640 2026] [:error] [pid 9157:tid 9183] [client 173.239.240.33:41145] [client 173.239.240.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.33, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9GrcGfHcLNqE8m88K6CgAAAZg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 01:55:10.073075 2026] [:error] [pid 9188:tid 9199] [client 2.57.168.24:25513] [client 2.57.168.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.24, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9G_rGYm6q5dNSUvA8QxQAAAcc"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 01:55:28.573867 2026] [:error] [pid 9157:tid 9180] [client 2.57.168.22:34899] [client 2.57.168.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.22, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9HEMGfHcLNqE8m88K6MgAAAZU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 01:56:42.487501 2026] [:error] [pid 9189:tid 9220] [client 2.57.168.9:52313] [client 2.57.168.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.9, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9HWpvTDh1NbYizKVzolQAAAgE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 01:57:29.978462 2026] [:error] [pid 49877:tid 49897] [client 2.57.168.25:52095] [client 2.57.168.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.25, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9HiRgN4MeSe4kIL9BYXwAAAAk"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 01:59:18.950068 2026] [:error] [pid 38463:tid 38657] [client 2.57.168.27:51181] [client 2.57.168.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.27, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9H9h4oIQTtH1fRix0gUgAAAlM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:00:35.318906 2026] [:error] [pid 9157:tid 9159] [client 2.57.168.18:38557] [client 2.57.168.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.18, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9IQ8GfHcLNqE8m88K6zQAAAYA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:01:38.769539 2026] [:error] [pid 49879:tid 49939] [client 2.57.168.32:46167] [client 2.57.168.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.32, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9IgoVqYDjFSyG2gFp5gwAAAFM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:02:51.868381 2026] [:error] [pid 49982:tid 49991] [client 2.57.168.8:61335] [client 2.57.168.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.8, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9Iy2FwIDa5Tf8O4bY5NAAAAMc"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:04:08.645636 2026] [:error] [pid 51613:tid 51629] [client 2.57.168.8:34323] [client 2.57.168.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.8, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9JGGbP0MDvqrVnweofwQAAAQ4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:05:17.547812 2026] [:error] [pid 9157:tid 9159] [client 2.57.168.29:31175] [client 2.57.168.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.29, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9JXcGfHcLNqE8m88K7tgAAAYA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:06:59.652059 2026] [:error] [pid 49877:tid 49888] [client 173.239.240.33:43853] [client 173.239.240.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.33, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9JwxgN4MeSe4kIL9BZhgAAAAA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:08:15.878561 2026] [:error] [pid 49982:tid 49998] [client 2.57.168.15:36375] [client 2.57.168.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.15, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9KD2FwIDa5Tf8O4bY5kQAAAM4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:09:13.487853 2026] [:error] [pid 9157:tid 9164] [client 2.57.168.31:39617] [client 2.57.168.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.31, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9KScGfHcLNqE8m88K8vgAAAYU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:10:29.674705 2026] [:error] [pid 49884:tid 49959] [client 2.57.168.29:26399] [client 2.57.168.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.29, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9Kla5MPpsTNNHWS6gz2gAAAIw"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:11:35.554547 2026] [:error] [pid 9188:tid 9205] [client 2.57.168.23:28835] [client 2.57.168.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.23, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9K17GYm6q5dNSUvA8SKAAAAc0"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:13:18.926448 2026] [:error] [pid 9157:tid 9182] [client 2.57.168.18:46579] [client 2.57.168.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.18, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9LPsGfHcLNqE8m88K90gAAAZc"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:14:34.841914 2026] [:error] [pid 38463:tid 38647] [client 2.57.168.27:61179] [client 2.57.168.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.27, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9Lih4oIQTtH1fRix0h2gAAAkk"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:15:46.993832 2026] [:error] [pid 38463:tid 38651] [client 2.57.168.27:28197] [client 2.57.168.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.27, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9L0h4oIQTtH1fRix0iDgAAAk0"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:16:58.709728 2026] [:error] [pid 9114:tid 9121] [client 2.57.168.31:56353] [client 2.57.168.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.31, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9MGm8FiJqDBEoTvqyXFgAAAUU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:18:23.980839 2026] [:error] [pid 51613:tid 51618] [client 2.57.168.30:42065] [client 2.57.168.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.30, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9Mb2bP0MDvqrVnweogqAAAAQM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:19:51.048516 2026] [:error] [pid 49877:tid 49912] [client 2.57.168.17:38071] [client 2.57.168.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.17, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9MxxgN4MeSe4kIL9BbDwAAABg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:21:19.721443 2026] [:error] [pid 9114:tid 9117] [client 2.57.168.11:40419] [client 2.57.168.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.11, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9NH28FiJqDBEoTvqyXbQAAAUE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:24:48.054328 2026] [:error] [pid 9157:tid 9171] [client 2.57.168.23:63689] [client 2.57.168.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.23, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9N8MGfHcLNqE8m88K_5gAAAYw"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:25:47.536932 2026] [:error] [pid 49877:tid 49908] [client 173.239.240.33:26957] [client 173.239.240.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.33, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9OKxgN4MeSe4kIL9BcKwAAABQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:26:25.286227 2026] [:error] [pid 9188:tid 9216] [client 2.57.168.13:25815] [client 2.57.168.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.13, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9OUbGYm6q5dNSUvA8T7QAAAdg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:27:32.278585 2026] [:error] [pid 9188:tid 9196] [client 2.57.168.8:25865] [client 2.57.168.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.8, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9OlLGYm6q5dNSUvA8T_AAAAcQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:29:04.883957 2026] [:error] [pid 9114:tid 9140] [client 2.57.168.20:55043] [client 2.57.168.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9O8G8FiJqDBEoTvqyXswAAAVg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:30:37.344611 2026] [:error] [pid 9188:tid 9205] [client 2.57.168.23:47999] [client 2.57.168.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.23, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9PTbGYm6q5dNSUvA8UVQAAAc0"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:31:48.447314 2026] [:error] [pid 9157:tid 9173] [client 2.57.168.27:36723] [client 2.57.168.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.27, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9PlMGfHcLNqE8m88LBBQAAAY4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:32:52.040218 2026] [:error] [pid 9188:tid 9210] [client 2.57.168.29:29499] [client 2.57.168.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.29, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9P1LGYm6q5dNSUvA8UZwAAAdI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:33:54.347935 2026] [:error] [pid 49877:tid 49894] [client 2.57.168.27:49581] [client 2.57.168.27] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.27, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9QEhgN4MeSe4kIL9Bc1wAAAAY"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:35:06.883495 2026] [:error] [pid 9189:tid 9237] [client 2.57.168.32:56531] [client 2.57.168.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.32, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9QWpvTDh1NbYizKVzrFwAAAhI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:35:48.050976 2026] [:error] [pid 49877:tid 49900] [client 2.57.168.21:45053] [client 2.57.168.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.21, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9QhBgN4MeSe4kIL9BdAQAAAAw"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:37:08.551016 2026] [:error] [pid 38463:tid 38657] [client 2.57.168.17:42121] [client 2.57.168.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.17, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9Q1B4oIQTtH1fRix0jmwAAAlM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:37:50.965075 2026] [:error] [pid 9157:tid 9162] [client 20.222.17.182:7273] [client 20.222.17.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/requests/src/response/about.php"] [unique_id "ag9Q_sGfHcLNqE8m88LB_AAAAYM"]
[Fri May 22 02:37:51.423430 2026] [:error] [pid 51613:tid 51627] [client 20.222.17.182:7233] [client 20.222.17.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.222.17.182, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9Q_2bP0MDvqrVnweohjQAAAQw"]
[Fri May 22 02:37:51.659547 2026] [:error] [pid 51613:tid 51615] [client 20.222.17.182:7233] [client 20.222.17.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.222.17.182, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ag9Q_2bP0MDvqrVnweohjwAAAQA"]
[Fri May 22 02:37:53.728840 2026] [:error] [pid 51613:tid 51628] [client 20.222.17.182:7233] [client 20.222.17.182] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.222.17.182, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9RAWbP0MDvqrVnweohoAAAAQ0"]
[Fri May 22 02:37:54.787755 2026] [:error] [pid 51613:tid 51632] [client 20.222.17.182:7233] [client 20.222.17.182] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.222.17.182, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ag9RAmbP0MDvqrVnweohqQAAARE"]
[Fri May 22 02:37:56.232747 2026] [:error] [pid 51613:tid 51634] [client 20.222.17.182:7233] [client 20.222.17.182] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ag9RBGbP0MDvqrVnweohtQAAARM"]
[Fri May 22 02:38:10.290806 2026] [:error] [pid 9188:tid 9206] [client 2.57.168.12:20819] [client 2.57.168.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.12, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9RErGYm6q5dNSUvA8UpAAAAc4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:38:57.544775 2026] [:error] [pid 49884:tid 49956] [client 2.57.168.13:54347] [client 2.57.168.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.13, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9RQa5MPpsTNNHWS6g18AAAAIk"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:39:49.368215 2026] [:error] [pid 49877:tid 49899] [client 2.57.168.21:50571] [client 2.57.168.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.21, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9RdRgN4MeSe4kIL9BdaAAAAAs"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:40:29.487111 2026] [:error] [pid 9188:tid 9215] [client 52.242.199.195:29929] [client 52.242.199.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.199.195, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ag9RnbGYm6q5dNSUvA8UzQAAAdc"]
[Fri May 22 02:40:31.613194 2026] [:error] [pid 9188:tid 9204] [client 52.242.199.195:29929] [client 52.242.199.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.199.195, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9Rn7GYm6q5dNSUvA8U0gAAAcw"]
[Fri May 22 02:40:32.700555 2026] [:error] [pid 9188:tid 9210] [client 52.242.199.195:29929] [client 52.242.199.195] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 52.242.199.195, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ag9RoLGYm6q5dNSUvA8U1QAAAdI"]
[Fri May 22 02:40:36.738809 2026] [:error] [pid 9188:tid 9201] [client 52.242.199.195:29929] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/index.php"] [unique_id "ag9RpLGYm6q5dNSUvA8U3AAAAck"]
[Fri May 22 02:40:41.484834 2026] [:error] [pid 9188:tid 9204] [client 52.242.199.195:29851] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "ag9RqbGYm6q5dNSUvA8U6AAAAcw"]
[Fri May 22 02:40:42.331026 2026] [:error] [pid 49877:tid 49896] [client 52.242.199.195:29904] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "ag9RqhgN4MeSe4kIL9BdoQAAAAg"]
[Fri May 22 02:40:44.346520 2026] [:error] [pid 9157:tid 9166] [client 52.242.199.195:29924] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/admiin.php"] [unique_id "ag9RrMGfHcLNqE8m88LCoQAAAYc"]
[Fri May 22 02:40:50.969759 2026] [:error] [pid 49884:tid 49958] [client 2.57.168.8:61099] [client 2.57.168.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.8, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9Rsq5MPpsTNNHWS6g2IwAAAIs"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:40:51.708655 2026] [:error] [pid 49884:tid 49953] [client 52.242.199.195:29927] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "ag9Rs65MPpsTNNHWS6g2KAAAAIY"]
[Fri May 22 02:40:56.701783 2026] [:error] [pid 9188:tid 9197] [client 52.242.199.195:29843] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/index.php"] [unique_id "ag9RuLGYm6q5dNSUvA8VBgAAAcU"]
[Fri May 22 02:40:58.335722 2026] [:error] [pid 51613:tid 51633] [client 52.242.199.195:29842] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/about.php"] [unique_id "ag9RumbP0MDvqrVnweoh4AAAARI"]
[Fri May 22 02:41:05.016186 2026] [:error] [pid 38463:tid 38640] [client 52.242.199.195:29944] [client 52.242.199.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.199.195, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-login.php"] [unique_id "ag9RwR4oIQTtH1fRix0kaAAAAkI"]
[Fri May 22 02:41:06.665057 2026] [:error] [pid 38463:tid 38646] [client 52.242.199.195:29944] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/button/index.php"] [unique_id "ag9Rwh4oIQTtH1fRix0kbAAAAkg"]
[Fri May 22 02:41:14.811438 2026] [:error] [pid 38463:tid 38640] [client 52.242.199.195:29942] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/admin.php"] [unique_id "ag9Ryh4oIQTtH1fRix0kfAAAAkI"]
[Fri May 22 02:41:18.164602 2026] [:error] [pid 49877:tid 49896] [client 52.242.199.195:29945] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/certificates/about.php"] [unique_id "ag9RzhgN4MeSe4kIL9BdvwAAAAg"]
[Fri May 22 02:41:23.001838 2026] [:error] [pid 51613:tid 51628] [client 52.242.199.195:29925] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/about.php"] [unique_id "ag9R02bP0MDvqrVnweoh8gAAAQ0"]
[Fri May 22 02:41:25.559349 2026] [:error] [pid 9157:tid 9165] [client 52.242.199.195:29844] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/about.php"] [unique_id "ag9R1cGfHcLNqE8m88LC1gAAAYY"]
[Fri May 22 02:41:27.155208 2026] [:error] [pid 49877:tid 49904] [client 52.242.199.195:29931] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/fonts/index.php"] [unique_id "ag9R1xgN4MeSe4kIL9Bd0AAAABA"]
[Fri May 22 02:41:29.340601 2026] [:error] [pid 9157:tid 9173] [client 52.242.199.195:29917] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/index.php"] [unique_id "ag9R2cGfHcLNqE8m88LC3QAAAY4"]
[Fri May 22 02:41:31.115323 2026] [:error] [pid 9157:tid 9164] [client 52.242.199.195:29914] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/about.php"] [unique_id "ag9R28GfHcLNqE8m88LC4QAAAYU"]
[Fri May 22 02:41:33.924384 2026] [:error] [pid 51613:tid 51636] [client 52.242.199.195:29933] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/index.php"] [unique_id "ag9R3WbP0MDvqrVnweoh_QAAARU"]
[Fri May 22 02:41:35.202967 2026] [:error] [pid 9157:tid 9166] [client 52.242.199.195:29853] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/lv.php"] [unique_id "ag9R38GfHcLNqE8m88LC5AAAAYc"]
[Fri May 22 02:41:43.717988 2026] [:error] [pid 51613:tid 51622] [client 52.242.199.195:29849] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "ag9R52bP0MDvqrVnweoiFwAAAQc"]
[Fri May 22 02:41:45.278003 2026] [:error] [pid 49884:tid 49953] [client 52.242.199.195:29937] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/index.php"] [unique_id "ag9R6a5MPpsTNNHWS6g2YgAAAIY"]
[Fri May 22 02:41:48.227214 2026] [proxy_fcgi:error] [pid 38463:tid 38639] [client 52.242.199.195:29833] AH01071: Got error 'Primary script unknown'
[Fri May 22 02:41:48.414578 2026] [:error] [pid 38463:tid 38648] [client 52.242.199.195:29833] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/chosen.php"] [unique_id "ag9R7B4oIQTtH1fRix0kkgAAAko"]
[Fri May 22 02:41:49.708005 2026] [proxy_fcgi:error] [pid 9157:tid 9173] [client 52.242.199.195:29918] AH01071: Got error 'Primary script unknown'
[Fri May 22 02:41:52.253180 2026] [:error] [pid 9157:tid 9180] [client 52.242.199.195:29918] [client 52.242.199.195] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 52.242.199.195, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/wp-login.php"] [unique_id "ag9R8MGfHcLNqE8m88LC8AAAAZU"]
[Fri May 22 02:41:55.707345 2026] [:error] [pid 9157:tid 9163] [client 52.242.199.195:29918] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/index.php"] [unique_id "ag9R88GfHcLNqE8m88LC-wAAAYQ"]
[Fri May 22 02:41:59.457418 2026] [:error] [pid 51613:tid 51628] [client 52.242.199.195:29901] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "ag9R92bP0MDvqrVnweoiKAAAAQ0"]
[Fri May 22 02:42:04.279017 2026] [:error] [pid 49877:tid 49894] [client 52.242.199.195:29847] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "ag9R_BgN4MeSe4kIL9BeEQAAAAY"]
[Fri May 22 02:42:04.895681 2026] [:error] [pid 9189:tid 9238] [client 52.242.199.195:29951] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/wordpress/images/index.php"] [unique_id "ag9R_JvTDh1NbYizKVzrdwAAAhM"]
[Fri May 22 02:42:08.024721 2026] [:error] [pid 49877:tid 49906] [client 173.239.240.33:53237] [client 173.239.240.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 173.239.240.33, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9SABgN4MeSe4kIL9BeEwAAABI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:42:10.362306 2026] [:error] [pid 9157:tid 9179] [client 52.242.199.195:29826] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/index.php"] [unique_id "ag9SAsGfHcLNqE8m88LDFAAAAZQ"]
[Fri May 22 02:42:11.224451 2026] [:error] [pid 49877:tid 49895] [client 52.242.199.195:3022] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/style-engine/wp-conflg.php"] [unique_id "ag9SAxgN4MeSe4kIL9BeFgAAAAc"]
[Fri May 22 02:42:11.650861 2026] [:error] [pid 49877:tid 49902] [client 52.242.199.195:29893] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/about.php"] [unique_id "ag9SAxgN4MeSe4kIL9BeGAAAAA4"]
[Fri May 22 02:42:16.380067 2026] [:error] [pid 9114:tid 9130] [client 52.242.199.195:29827] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ag9SCG8FiJqDBEoTvqyYWAAAAU4"]
[Fri May 22 02:42:18.789920 2026] [:error] [pid 9188:tid 9210] [client 52.242.199.195:29855] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/php-compat/index.php"] [unique_id "ag9SCrGYm6q5dNSUvA8VbwAAAdI"]
[Fri May 22 02:42:21.271431 2026] [:error] [pid 38463:tid 38661] [client 52.242.199.195:29857] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/xwx1.php"] [unique_id "ag9SDR4oIQTtH1fRix0kqAAAAlc"]
[Fri May 22 02:42:22.265600 2026] [:error] [pid 38463:tid 38642] [client 52.242.199.195:29894] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ag9SDh4oIQTtH1fRix0kqQAAAkQ"]
[Fri May 22 02:42:23.296482 2026] [:error] [pid 49884:tid 49956] [client 52.242.199.195:29950] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/index.php"] [unique_id "ag9SD65MPpsTNNHWS6g2bgAAAIk"]
[Fri May 22 02:42:25.170166 2026] [:error] [pid 9157:tid 9166] [client 52.242.199.195:29935] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/smilies/admin.php"] [unique_id "ag9SEcGfHcLNqE8m88LDIQAAAYc"]
[Fri May 22 02:42:29.354630 2026] [:error] [pid 9157:tid 9176] [client 52.242.199.195:29825] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css.php"] [unique_id "ag9SFcGfHcLNqE8m88LDMgAAAZE"]
[Fri May 22 02:42:32.288569 2026] [:error] [pid 49877:tid 49908] [client 52.242.199.195:3051] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/index.php"] [unique_id "ag9SGBgN4MeSe4kIL9BeQQAAABQ"]
[Fri May 22 02:42:33.409143 2026] [:error] [pid 9114:tid 9131] [client 52.242.199.195:29887] [client 52.242.199.195] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/about.php"] [unique_id "ag9SGW8FiJqDBEoTvqyYXQAAAU8"]
[Fri May 22 02:42:50.163996 2026] [:error] [pid 51613:tid 51629] [client 2.57.168.29:41481] [client 2.57.168.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.29, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9SKmbP0MDvqrVnweoiNQAAAQ4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:44:33.722101 2026] [:error] [pid 49884:tid 49966] [client 2.57.168.25:22547] [client 2.57.168.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.25, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9Ska5MPpsTNNHWS6g2xQAAAJM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:45:24.086252 2026] [:error] [pid 9188:tid 9203] [client 2.57.168.13:29977] [client 2.57.168.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.13, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9SxLGYm6q5dNSUvA8V2gAAAcs"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:46:54.685416 2026] [:error] [pid 9188:tid 9203] [client 2.57.168.13:49419] [client 2.57.168.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.13, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9THrGYm6q5dNSUvA8V_wAAAcs"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:48:09.484061 2026] [:error] [pid 9189:tid 9238] [client 2.57.168.8:52857] [client 2.57.168.8] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.8, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9TaZvTDh1NbYizKVzsRAAAAhM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:49:09.065278 2026] [:error] [pid 9188:tid 9206] [client 2.57.168.10:59823] [client 2.57.168.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.10, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9TpbGYm6q5dNSUvA8WJAAAAc4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:50:05.220066 2026] [:error] [pid 9188:tid 9212] [client 2.57.168.13:31841] [client 2.57.168.13] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.13, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9T3bGYm6q5dNSUvA8WOwAAAdQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:51:38.733807 2026] [:error] [pid 9157:tid 9168] [client 2.57.168.7:21227] [client 2.57.168.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.7, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9UOsGfHcLNqE8m88LE7AAAAYk"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:52:15.471360 2026] [:error] [pid 9189:tid 9243] [client 2.57.168.17:23251] [client 2.57.168.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.17, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9UX5vTDh1NbYizKVzsaAAAAhg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:53:24.448034 2026] [:error] [pid 9189:tid 9233] [client 2.57.168.16:25591] [client 2.57.168.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.16, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9UpJvTDh1NbYizKVzsiAAAAg4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:54:43.160790 2026] [:error] [pid 49877:tid 49895] [client 2.57.168.9:52851] [client 2.57.168.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.9, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9U8xgN4MeSe4kIL9BgogAAAAc"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:56:01.027938 2026] [:error] [pid 49884:tid 49959] [client 2.57.168.33:64755] [client 2.57.168.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.33, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9VQa5MPpsTNNHWS6g3gQAAAIw"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:57:22.271091 2026] [:error] [pid 49877:tid 49891] [client 2.57.168.10:43505] [client 2.57.168.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.10, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9VkhgN4MeSe4kIL9BhSQAAAAM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:58:24.949623 2026] [:error] [pid 9114:tid 9126] [client 2.57.168.32:26771] [client 2.57.168.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.32, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9V0G8FiJqDBEoTvqyZXgAAAUo"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 02:59:26.872606 2026] [:error] [pid 9189:tid 9234] [client 2.57.168.11:29749] [client 2.57.168.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.11, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9WDpvTDh1NbYizKVztbgAAAg8"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:00:29.830009 2026] [:error] [pid 49884:tid 49958] [client 2.57.168.10:44597] [client 2.57.168.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.10, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9WTa5MPpsTNNHWS6g4CAAAAIs"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:01:30.752176 2026] [:error] [pid 38463:tid 38651] [client 2.57.168.30:21421] [client 2.57.168.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.30, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9Wih4oIQTtH1fRix0nggAAAk0"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:03:10.175030 2026] [:error] [pid 49877:tid 49910] [client 2.57.168.20:33633] [client 2.57.168.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9W7hgN4MeSe4kIL9Bi3wAAABY"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:04:49.634059 2026] [:error] [pid 49877:tid 49891] [client 2.57.168.25:61277] [client 2.57.168.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.25, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9XURgN4MeSe4kIL9BjCwAAAAM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:06:28.559846 2026] [:error] [pid 9188:tid 9202] [client 2.57.168.23:61599] [client 2.57.168.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.23, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9XtLGYm6q5dNSUvA8YTgAAAco"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:07:38.849290 2026] [:error] [pid 9114:tid 9135] [client 2.57.168.25:29941] [client 2.57.168.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.25, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9X-m8FiJqDBEoTvqyabgAAAVM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:08:43.077872 2026] [:error] [pid 49884:tid 49955] [client 2.57.168.15:21625] [client 2.57.168.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.15, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9YO65MPpsTNNHWS6g4ugAAAIg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:09:27.173504 2026] [:error] [pid 9157:tid 9164] [client 2.57.168.32:52681] [client 2.57.168.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.32, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9YZ8GfHcLNqE8m88LKFAAAAYU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:10:13.824265 2026] [:error] [pid 49879:tid 49937] [client 2.57.168.11:34475] [client 2.57.168.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.11, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9YlYVqYDjFSyG2gFp80QAAAFE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:12:03.232111 2026] [:error] [pid 38463:tid 38658] [client 2.57.168.20:24191] [client 2.57.168.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9ZAx4oIQTtH1fRix0pRwAAAlQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:13:20.855627 2026] [:error] [pid 9189:tid 9234] [client 2.57.168.10:62329] [client 2.57.168.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.10, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9ZUJvTDh1NbYizKVzulgAAAg8"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:15:17.375794 2026] [:error] [pid 9157:tid 9164] [client 2.57.168.17:39971] [client 2.57.168.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.17, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9ZxcGfHcLNqE8m88LLfgAAAYU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:17:39.929474 2026] [:error] [pid 9114:tid 9117] [client 2.57.168.15:43261] [client 2.57.168.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.15, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9aU28FiJqDBEoTvqya4gAAAUE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:18:58.563397 2026] [:error] [pid 9189:tid 9221] [client 2.57.168.26:27155] [client 2.57.168.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.26, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9aopvTDh1NbYizKVzvLgAAAgI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:20:41.363053 2026] [:error] [pid 9189:tid 9223] [client 2.57.168.25:55193] [client 2.57.168.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.25, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9bCZvTDh1NbYizKVzvSgAAAgQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:22:25.135456 2026] [:error] [pid 49982:tid 49987] [client 2.57.168.11:65329] [client 2.57.168.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.11, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9bcWFwIDa5Tf8O4bY-nQAAAMM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:23:37.231035 2026] [:error] [pid 49982:tid 49995] [client 2.57.168.23:54751] [client 2.57.168.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.23, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9buWFwIDa5Tf8O4bY-tgAAAMs"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:24:56.769388 2026] [:error] [pid 9157:tid 9159] [client 2.57.168.7:40881] [client 2.57.168.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.7, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9cCMGfHcLNqE8m88LN2AAAAYA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:26:47.746568 2026] [:error] [pid 9189:tid 9242] [client 2.57.168.16:61989] [client 2.57.168.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.16, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9cd5vTDh1NbYizKVzv9QAAAhc"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:27:55.604221 2026] [:error] [pid 9157:tid 9178] [client 2.57.168.30:62469] [client 2.57.168.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.30, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9cu8GfHcLNqE8m88LOmQAAAZM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:28:34.925930 2026] [:error] [pid 9157:tid 9167] [client 2.57.168.20:46143] [client 2.57.168.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9c4sGfHcLNqE8m88LO1wAAAYg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:29:33.237034 2026] [:error] [pid 51613:tid 51620] [client 2.57.168.14:62359] [client 2.57.168.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9dHWbP0MDvqrVnweoligAAAQU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:31:27.625667 2026] [:error] [pid 9157:tid 9165] [client 2.57.168.22:58733] [client 2.57.168.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.22, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9dj8GfHcLNqE8m88LPsAAAAYY"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:32:13.625152 2026] [:error] [pid 49884:tid 49948] [client 2.57.168.22:64099] [client 2.57.168.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.22, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9dva5MPpsTNNHWS6g7QQAAAIE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:33:40.457830 2026] [:error] [pid 49877:tid 49907] [client 2.57.168.17:23833] [client 2.57.168.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.17, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9eFBgN4MeSe4kIL9BntwAAABM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:35:02.476622 2026] [:error] [pid 49884:tid 49969] [client 2.57.168.23:55411] [client 2.57.168.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.23, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9eZq5MPpsTNNHWS6g7bQAAAJY"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:36:11.830671 2026] [:error] [pid 9157:tid 9161] [client 2.57.168.14:48261] [client 2.57.168.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9eq8GfHcLNqE8m88LQfQAAAYI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:37:27.861602 2026] [:error] [pid 51613:tid 51619] [client 2.57.168.11:26325] [client 2.57.168.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.11, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9e92bP0MDvqrVnweomaAAAAQQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:38:58.272387 2026] [:error] [pid 9189:tid 9228] [client 2.57.168.16:23253] [client 2.57.168.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.16, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9fUpvTDh1NbYizKVzxFwAAAgk"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:40:21.039364 2026] [:error] [pid 38463:tid 38647] [client 2.57.168.15:22633] [client 2.57.168.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.15, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9fpR4oIQTtH1fRix0s6wAAAkk"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:41:26.030874 2026] [:error] [pid 49877:tid 49909] [client 2.57.168.15:61661] [client 2.57.168.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.15, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9f5hgN4MeSe4kIL9BpJgAAABU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:42:49.967518 2026] [:error] [pid 9188:tid 9212] [client 2.57.168.21:32501] [client 2.57.168.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.21, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9gObGYm6q5dNSUvA8cTgAAAdQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:44:11.186961 2026] [:error] [pid 9189:tid 9219] [client 2.57.168.7:28015] [client 2.57.168.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.7, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9gi5vTDh1NbYizKVzyEQAAAgA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:45:20.060885 2026] [:error] [pid 9114:tid 9135] [client 2.57.168.10:43551] [client 2.57.168.10] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.10, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9g0G8FiJqDBEoTvqydJgAAAVM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:46:15.569103 2026] [:error] [pid 10351:tid 10362] [client 2.57.168.21:44977] [client 2.57.168.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.21, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9hByEXs4szA-4jEaEVVgAAAMk"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:47:59.453537 2026] [:error] [pid 11212:tid 11237] [client 2.57.168.12:38259] [client 2.57.168.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.12, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9hb0JN8jHvJelS8HY6qwAAANc"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:48:55.964760 2026] [:error] [pid 11120:tid 11193] [client 2.57.168.31:50239] [client 2.57.168.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.31, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9hp0zkd-UBoOXB8ZFwfQAAAJE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:49:54.177495 2026] [:error] [pid 11212:tid 11214] [client 2.57.168.18:54143] [client 2.57.168.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.18, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9h4kJN8jHvJelS8HY75AAAAMA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:51:04.048193 2026] [:error] [pid 14336:tid 14343] [client 2.57.168.22:25579] [client 2.57.168.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.22, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9iKC88l1D7PDtPqGnHZQAAAQU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:52:29.659098 2026] [:error] [pid 14235:tid 14248] [client 2.57.168.7:61565] [client 2.57.168.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.7, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9ifT_DPUCwdPr4mw5NsgAAAAk"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:53:48.677738 2026] [:error] [pid 14237:tid 14303] [client 2.57.168.21:34281] [client 2.57.168.21] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.21, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9izDvUiOze8L48Z8vBqwAAAIo"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:55:15.275302 2026] [:error] [pid 14237:tid 14295] [client 2.57.168.33:36265] [client 2.57.168.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.33, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9jIzvUiOze8L48Z8vCDAAAAII"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:56:21.324413 2026] [:error] [pid 14236:tid 14275] [client 2.57.168.24:41731] [client 2.57.168.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.24, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9jZc07Ya_yCHXu0xrjkQAAAEk"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:57:34.724912 2026] [:error] [pid 14336:tid 14349] [client 2.57.168.12:53547] [client 2.57.168.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.12, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9jri88l1D7PDtPqGnKQQAAAQs"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 03:59:29.143326 2026] [:error] [pid 49391:tid 49443] [client 2.57.168.7:23159] [client 2.57.168.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.7, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9kIYOYSn6xUjFbpXKZPwAAAFQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:00:44.551472 2026] [:error] [pid 49480:tid 49503] [client 2.57.168.24:25111] [client 2.57.168.24] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.24, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9kbM7gnnlW660htkYUgAAAANU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:02:00.938255 2026] [:error] [pid 49390:tid 49414] [client 2.57.168.20:58085] [client 2.57.168.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9kuEfnx7H5csWqCDAafwAAABM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:03:13.559252 2026] [:error] [pid 49392:tid 49468] [client 2.57.168.16:37283] [client 2.57.168.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.16, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9lAd6KX5mDbYUc-fvBDwAAAJI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:04:17.567865 2026] [:error] [pid 49391:tid 49439] [client 2.57.168.17:43733] [client 2.57.168.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.17, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9lQYOYSn6xUjFbpXKbLQAAAFA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:05:37.223189 2026] [:error] [pid 49391:tid 49438] [client 2.57.168.18:40961] [client 2.57.168.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.18, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9lkYOYSn6xUjFbpXKbhQAAAE8"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:06:58.875771 2026] [:error] [pid 15679:tid 15705] [client 2.57.168.12:53367] [client 2.57.168.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.12, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9l4ih8tgGc38WJ-GxFjAAAANg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:08:10.832913 2026] [:error] [pid 15585:tid 15657] [client 2.57.168.32:52059] [client 2.57.168.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.32, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9mKiKb-vB41AF-LC0fdAAAAIo"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:09:36.864212 2026] [:error] [pid 15679:tid 15690] [client 2.57.168.25:58525] [client 2.57.168.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.25, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9mgCh8tgGc38WJ-GxG0wAAAMk"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:10:39.989532 2026] [:error] [pid 15584:tid 15642] [client 2.57.168.12:63965] [client 2.57.168.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.12, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9mv99Z_TVLbNEx52hgoAAAAFY"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:11:34.111519 2026] [:error] [pid 15584:tid 15622] [client 2.57.168.18:39601] [client 2.57.168.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.18, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9m9t9Z_TVLbNEx52hg2wAAAEI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:12:46.859362 2026] [:error] [pid 15584:tid 15622] [client 2.57.168.25:25645] [client 2.57.168.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.25, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9nPt9Z_TVLbNEx52hhOwAAAEI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:14:10.587131 2026] [:error] [pid 15679:tid 15686] [client 2.57.168.25:39479] [client 2.57.168.25] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.25, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9nkih8tgGc38WJ-GxI_gAAAMU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:15:25.974533 2026] [:error] [pid 15679:tid 15691] [client 2.57.168.15:34557] [client 2.57.168.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.15, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9n3Sh8tgGc38WJ-GxJjQAAAMo"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:16:25.863244 2026] [:error] [pid 15584:tid 15637] [client 2.57.168.14:21441] [client 2.57.168.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9oGd9Z_TVLbNEx52hiRQAAAFE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:18:15.550140 2026] [:error] [pid 15585:tid 15661] [client 2.57.168.22:36019] [client 2.57.168.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.22, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9ohyKb-vB41AF-LC0iqAAAAI4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:19:14.790672 2026] [:error] [pid 15679:tid 15705] [client 2.57.168.11:34325] [client 2.57.168.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.11, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9owih8tgGc38WJ-GxK5QAAANg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:20:47.781353 2026] [:error] [pid 15679:tid 15684] [client 2.57.168.17:20119] [client 2.57.168.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.17, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9pHyh8tgGc38WJ-GxLcgAAAMM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:21:46.564599 2026] [:error] [pid 15584:tid 15635] [client 2.57.168.18:28261] [client 2.57.168.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.18, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9pWt9Z_TVLbNEx52hjaAAAAE8"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:22:56.939344 2026] [:error] [pid 15679:tid 15699] [client 2.57.168.9:21225] [client 2.57.168.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.9, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9poCh8tgGc38WJ-GxMjwAAANI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:24:33.887753 2026] [:error] [pid 15585:tid 15648] [client 2.57.168.30:54569] [client 2.57.168.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.30, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9qASKb-vB41AF-LC0kGwAAAIE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:25:32.753138 2026] [:error] [pid 15584:tid 15641] [client 2.57.168.14:50083] [client 2.57.168.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9qPN9Z_TVLbNEx52hkYwAAAFU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:27:02.381848 2026] [:error] [pid 15679:tid 15685] [client 2.57.168.22:41975] [client 2.57.168.22] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.22, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9qlih8tgGc38WJ-GxOWAAAAMQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:28:14.533249 2026] [:error] [pid 15679:tid 15681] [client 2.57.168.12:51561] [client 2.57.168.12] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.12, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9q3ih8tgGc38WJ-GxOyAAAAMA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:30:36.731416 2026] [:error] [pid 15584:tid 15628] [client 2.57.168.30:38553] [client 2.57.168.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.30, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9rbN9Z_TVLbNEx52hlnAAAAEg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:31:52.370906 2026] [:error] [pid 15679:tid 15701] [client 2.57.168.15:39071] [client 2.57.168.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.15, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9ruCh8tgGc38WJ-GxQWgAAANQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:33:30.924691 2026] [:error] [pid 15583:tid 15606] [client 2.57.168.18:56987] [client 2.57.168.18] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.18, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9sGnnaOncRcIm17YVlugAAABI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:34:57.674360 2026] [:error] [pid 15584:tid 15630] [client 2.57.168.26:55467] [client 2.57.168.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.26, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9scd9Z_TVLbNEx52hmpgAAAEo"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:36:02.770194 2026] [:error] [pid 15679:tid 15699] [client 2.57.168.7:53201] [client 2.57.168.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.7, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9ssih8tgGc38WJ-GxSrAAAANI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:38:21.941115 2026] [:error] [pid 15583:tid 15612] [client 2.57.168.29:55713] [client 2.57.168.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.29, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9tPXnaOncRcIm17YVmyAAAABg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:40:20.484244 2026] [:error] [pid 15583:tid 15596] [client 2.57.168.31:32955] [client 2.57.168.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.31, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9ttHnaOncRcIm17YVnQQAAAAg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:42:04.820895 2026] [:error] [pid 15583:tid 15588] [client 2.57.168.29:22455] [client 2.57.168.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.29, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9uHHnaOncRcIm17YVnpQAAAAA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:43:18.048223 2026] [:error] [pid 15583:tid 15611] [client 2.57.168.9:31159] [client 2.57.168.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.9, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9uZnnaOncRcIm17YVn1wAAABc"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:45:20.950692 2026] [:error] [pid 15679:tid 15683] [client 2.57.168.20:56431] [client 2.57.168.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9u4Ch8tgGc38WJ-GxXDwAAAMI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:47:17.319088 2026] [:error] [pid 15583:tid 15610] [client 2.57.168.23:55901] [client 2.57.168.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.23, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9vVXnaOncRcIm17YVosQAAABY"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:49:07.932917 2026] [:error] [pid 15679:tid 15694] [client 2.57.168.17:64859] [client 2.57.168.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.17, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9vwyh8tgGc38WJ-GxYWAAAAM0"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:50:20.454379 2026] [:error] [pid 15583:tid 15607] [client 2.57.168.17:29891] [client 2.57.168.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.17, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9wDHnaOncRcIm17YVpKgAAABM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:51:17.273320 2026] [:error] [pid 15679:tid 15701] [client 2.57.168.31:42451] [client 2.57.168.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.31, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9wRSh8tgGc38WJ-GxZEAAAANQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:52:27.436957 2026] [:error] [pid 15679:tid 15697] [client 2.57.168.33:38911] [client 2.57.168.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.33, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9wiyh8tgGc38WJ-GxZSAAAANA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:53:38.721947 2026] [:error] [pid 15583:tid 15590] [client 2.57.168.11:32135] [client 2.57.168.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.11, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9w0nnaOncRcIm17YVplgAAAAI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:53:57.674223 2026] [:error] [pid 15679:tid 15688] [client 2.57.168.16:29631] [client 2.57.168.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.16, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9w5Sh8tgGc38WJ-GxZlwAAAMc"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:55:39.030759 2026] [:error] [pid 15585:tid 15668] [client 2.57.168.14:39351] [client 2.57.168.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9xSyKb-vB41AF-LC0rPwAAAJU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:56:54.234404 2026] [:error] [pid 15679:tid 15683] [client 2.57.168.7:48993] [client 2.57.168.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.7, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9xlih8tgGc38WJ-GxaXgAAAMI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:57:56.928376 2026] [:error] [pid 15585:tid 15665] [client 2.57.168.31:58941] [client 2.57.168.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.31, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9x1CKb-vB41AF-LC0rngAAAJI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 04:59:00.553999 2026] [:error] [pid 15583:tid 15611] [client 2.57.168.29:61323] [client 2.57.168.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.29, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9yFHnaOncRcIm17YVqZwAAABc"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:00:26.438170 2026] [:error] [pid 15585:tid 15648] [client 2.57.168.7:34427] [client 2.57.168.7] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.7, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9yaiKb-vB41AF-LC0sCAAAAIE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:01:24.939761 2026] [:error] [pid 58782:tid 58789] [client 2.57.168.17:27969] [client 2.57.168.17] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.17, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9ypIxsdTFafgO8vhSiuQAAAQU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:03:02.881217 2026] [:error] [pid 58813:tid 58838] [client 2.57.168.29:51755] [client 2.57.168.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.29, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9zBp6yyKWDKULhxJ3xvAAAAVY"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:04:13.887803 2026] [:error] [pid 15585:tid 15671] [client 2.57.168.20:39041] [client 2.57.168.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9zTSKb-vB41AF-LC0swwAAAJg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:06:02.149628 2026] [:error] [pid 15585:tid 15652] [client 2.57.168.14:28703] [client 2.57.168.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9zuiKb-vB41AF-LC0tNQAAAIU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:07:34.326008 2026] [:error] [pid 15583:tid 15598] [client 2.57.168.16:45907] [client 2.57.168.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.16, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag90FnnaOncRcIm17YVr6gAAAAo"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:09:11.163448 2026] [:error] [pid 58813:tid 58837] [client 2.57.168.29:25663] [client 2.57.168.29] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.29, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag90d56yyKWDKULhxJ3yjgAAAVU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:09:57.662423 2026] [:error] [pid 15583:tid 15612] [client 2.57.168.31:24365] [client 2.57.168.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.31, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag90pXnaOncRcIm17YVspQAAABg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:11:00.261232 2026] [:error] [pid 15679:tid 15695] [client 2.57.168.14:62703] [client 2.57.168.14] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.14, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag905Ch8tgGc38WJ-Gxc3QAAAM4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:11:50.277066 2026] [:error] [pid 15585:tid 15648] [client 2.57.168.33:28037] [client 2.57.168.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.33, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag91FiKb-vB41AF-LC0u0QAAAIE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:13:09.218384 2026] [:error] [pid 15584:tid 15620] [client 2.57.168.31:26389] [client 2.57.168.31] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.31, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag91Zd9Z_TVLbNEx52huWwAAAEA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:14:33.057581 2026] [:error] [pid 15585:tid 15661] [client 2.57.168.33:60871] [client 2.57.168.33] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.33, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag91uSKb-vB41AF-LC0vdgAAAI4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:15:34.489223 2026] [:error] [pid 15585:tid 15651] [client 2.57.168.16:37795] [client 2.57.168.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.16, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag919iKb-vB41AF-LC0vugAAAIQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:16:59.630556 2026] [:error] [pid 15583:tid 15612] [client 2.57.168.23:45543] [client 2.57.168.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.23, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag92S3naOncRcIm17YVtgQAAABg"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:18:38.577502 2026] [:error] [pid 15585:tid 15647] [client 2.57.168.20:47913] [client 2.57.168.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag92riKb-vB41AF-LC0wMAAAAIA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:19:47.621849 2026] [:error] [pid 58782:tid 58798] [client 2.57.168.30:22319] [client 2.57.168.30] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.30, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag9284xsdTFafgO8vhSkugAAAQ4"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:21:50.485675 2026] [:error] [pid 15585:tid 15667] [client 2.57.168.16:62011] [client 2.57.168.16] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.16, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag93biKb-vB41AF-LC0w4gAAAJQ"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:23:09.028473 2026] [:error] [pid 15679:tid 15693] [client 2.57.168.26:38379] [client 2.57.168.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.26, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag93vSh8tgGc38WJ-GxfdwAAAMw"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:24:52.742005 2026] [:error] [pid 15584:tid 15637] [client 2.57.168.9:52459] [client 2.57.168.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.9, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag94JN9Z_TVLbNEx52hwpAAAAFE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:25:53.834515 2026] [:error] [pid 15584:tid 15622] [client 2.57.168.32:56029] [client 2.57.168.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.32, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag94Yd9Z_TVLbNEx52hw4wAAAEI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:27:55.799674 2026] [:error] [pid 15584:tid 15637] [client 2.57.168.26:41705] [client 2.57.168.26] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.26, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag94299Z_TVLbNEx52hxbwAAAFE"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:29:35.227773 2026] [:error] [pid 15584:tid 15625] [client 2.57.168.20:34257] [client 2.57.168.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag95P99Z_TVLbNEx52hxoAAAAEU"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:30:46.091639 2026] [:error] [pid 15584:tid 15620] [client 2.57.168.32:58561] [client 2.57.168.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.32, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag95ht9Z_TVLbNEx52hx0gAAAEA"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:32:09.662442 2026] [:error] [pid 58813:tid 58828] [client 2.57.168.32:21667] [client 2.57.168.32] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.32, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag952Z6yyKWDKULhxJ313gAAAUw"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:33:57.642518 2026] [:error] [pid 15583:tid 15591] [client 2.57.168.9:53849] [client 2.57.168.9] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.9, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag96RXnaOncRcIm17YVw7QAAAAM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:34:51.471114 2026] [:error] [pid 15584:tid 15638] [client 2.57.168.20:50425] [client 2.57.168.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag96e99Z_TVLbNEx52hylQAAAFI"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:35:57.260127 2026] [:error] [pid 15585:tid 15650] [client 2.57.168.11:57321] [client 2.57.168.11] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.11, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag96vSKb-vB41AF-LC01TwAAAIM"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:37:13.229621 2026] [:error] [pid 15584:tid 15632] [client 2.57.168.15:33063] [client 2.57.168.15] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.15, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag97Cd9Z_TVLbNEx52hy6QAAAEw"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 05:38:25.761840 2026] [:error] [pid 15585:tid 15660] [client 2.57.168.23:41973] [client 2.57.168.23] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 2.57.168.23, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag97USKb-vB41AF-LC02JwAAAI0"], referer: https://paramountestate.com.au/wp-login.php
[Fri May 22 10:05:20.758943 2026] [:error] [pid 15585:tid 15652] [client 46.101.73.244:58522] [client 46.101.73.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.73.244, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag-54CKb-vB41AF-LC2rCQAAAIU"]
[Fri May 22 10:05:21.765777 2026] [:error] [pid 15679:tid 15695] [client 46.101.73.244:58644] [client 46.101.73.244] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 46.101.73.244, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag-54Sh8tgGc38WJ-Gy44gAAAM4"]
[Fri May 22 10:08:19.374884 2026] [:error] [pid 15583:tid 15590] [client 157.230.23.20:51473] [client 157.230.23.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.23.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag-6k3naOncRcIm17YWoFwAAAAI"]
[Fri May 22 10:08:22.147052 2026] [:error] [pid 58782:tid 58800] [client 157.230.23.20:51721] [client 157.230.23.20] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 157.230.23.20, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ag-6loxsdTFafgO8vhTQ-gAAARA"]
[Fri May 22 14:41:32.277470 2026] [:error] [pid 15585:tid 15656] [client 103.137.93.63:54995] [client 103.137.93.63] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 103.137.93.63, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ag_6nCKb-vB41AF-LC0TFwAAAIk"]
[Fri May 22 14:44:30.320570 2026] [:error] [pid 15585:tid 15660] [client 185.132.187.152:40707] [client 185.132.187.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403x.php"] [unique_id "ag_7TiKb-vB41AF-LC0UGgAAAI0"]
[Fri May 22 14:44:31.157499 2026] [:error] [pid 15679:tid 15686] [client 82.197.193.74:54665] [client 82.197.193.74] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/semrush/x.php"] [unique_id "ag_7Tyh8tgGc38WJ-GwH-QAAAMU"]
[Fri May 22 14:44:31.994838 2026] [:error] [pid 15585:tid 15666] [client 82.197.193.143:53073] [client 82.197.193.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hello-plus/classes/ehp-sarang.php"] [unique_id "ag_7TyKb-vB41AF-LC0UIQAAAJM"]
[Fri May 22 14:44:32.858789 2026] [:error] [pid 15585:tid 15659] [client 82.197.193.199:35287] [client 82.197.193.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "ag_7UCKb-vB41AF-LC0UJAAAAIw"]
[Fri May 22 14:44:33.713466 2026] [:error] [pid 15583:tid 15596] [client 82.197.193.251:59209] [client 82.197.193.251] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/WPManager/up.php"] [unique_id "ag_7UXnaOncRcIm17YXbwgAAAAg"]
[Fri May 22 14:44:34.557690 2026] [:error] [pid 58782:tid 58798] [client 82.197.193.191:36341] [client 82.197.193.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/builder-and-developer/inc/tgm/error.php"] [unique_id "ag_7UoxsdTFafgO8vhT6HwAAAQ4"]
[Fri May 22 14:44:35.421470 2026] [:error] [pid 15584:tid 15630] [client 185.132.187.175:27387] [client 185.132.187.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-responsive-menu/inc/js/ace-min-noconflict/403x.php"] [unique_id "ag_7U99Z_TVLbNEx52jtwgAAAEo"]
[Fri May 22 14:44:36.295867 2026] [:error] [pid 15583:tid 15607] [client 185.132.187.203:36917] [client 185.132.187.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/advanced-llms-txt-generator/assets/css/css_json.php"] [unique_id "ag_7VHnaOncRcIm17YXbxwAAABM"]
[Fri May 22 14:44:37.168245 2026] [:error] [pid 15584:tid 15620] [client 185.132.187.204:63895] [client 185.132.187.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/age-restriction/modules/remote_support/remote_init.php"] [unique_id "ag_7Vd9Z_TVLbNEx52jtxgAAAEA"]
[Fri May 22 14:44:38.002134 2026] [:error] [pid 58782:tid 58808] [client 185.132.187.218:23545] [client 185.132.187.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfive/patterns/template-singl-portfolio.php"] [unique_id "ag_7VoxsdTFafgO8vhT6IAAAARg"]
[Fri May 22 14:44:38.902684 2026] [:error] [pid 58813:tid 58825] [client 82.197.193.145:20843] [client 82.197.193.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/advanced-product-fields-for-woocommerce/db.php"] [unique_id "ag_7Vp6yyKWDKULhxJ1UkwAAAUk"]
[Fri May 22 14:44:39.785885 2026] [:error] [pid 15583:tid 15609] [client 82.197.193.95:32285] [client 82.197.193.95] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/template-singl-portfolio.php"] [unique_id "ag_7V3naOncRcIm17YXbzAAAABU"]
[Fri May 22 14:44:40.645538 2026] [:error] [pid 15583:tid 15594] [client 185.132.187.230:47437] [client 185.132.187.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentythree/patterns/index.php"] [unique_id "ag_7WHnaOncRcIm17YXbzwAAAAY"]
[Fri May 22 14:44:41.503748 2026] [:error] [pid 58782:tid 58800] [client 82.197.193.205:60531] [client 82.197.193.205] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/index.php"] [unique_id "ag_7WYxsdTFafgO8vhT6JQAAARA"]
[Fri May 22 14:44:42.442195 2026] [:error] [pid 58782:tid 58805] [client 185.132.187.251:34551] [client 185.132.187.251] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wpforms/class-wpforms-update.php"] [unique_id "ag_7WoxsdTFafgO8vhT6JgAAARU"]
[Fri May 22 14:44:43.344109 2026] [:error] [pid 15679:tid 15697] [client 185.132.187.158:59887] [client 185.132.187.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/phpadmin/autoload_classmap.php"] [unique_id "ag_7Wyh8tgGc38WJ-GwIAgAAANA"]
[Fri May 22 14:44:44.246211 2026] [:error] [pid 15679:tid 15684] [client 185.132.187.219:26857] [client 185.132.187.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/js-inc.php"] [unique_id "ag_7XCh8tgGc38WJ-GwIBAAAAMM"]
[Fri May 22 14:44:46.591077 2026] [:error] [pid 15585:tid 15669] [client 185.132.187.218:35229] [client 185.132.187.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wpcall-button/button-image.php"] [unique_id "ag_7XiKb-vB41AF-LC0UPwAAAJY"]
[Fri May 22 14:44:47.503564 2026] [:error] [pid 58782:tid 58807] [client 185.132.187.150:31003] [client 185.132.187.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/SecurityFin/SecurityFin.php"] [unique_id "ag_7X4xsdTFafgO8vhT6KAAAARc"]
[Fri May 22 14:44:48.427319 2026] [:error] [pid 15679:tid 15690] [client 82.197.193.95:41711] [client 82.197.193.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/fukasawa/inc/classes/403.php"] [unique_id "ag_7YCh8tgGc38WJ-GwICgAAAMk"]
[Fri May 22 14:44:49.301998 2026] [:error] [pid 58782:tid 58791] [client 82.197.193.215:26915] [client 82.197.193.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hello-plus/classes/ehp-social-elf.php"] [unique_id "ag_7YYxsdTFafgO8vhT6KQAAAQc"]
[Fri May 22 14:44:50.157335 2026] [:error] [pid 15585:tid 15668] [client 82.197.193.215:22319] [client 82.197.193.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/theme-check/theme-check.php"] [unique_id "ag_7YiKb-vB41AF-LC0USAAAAJU"]
[Fri May 22 14:44:51.004445 2026] [:error] [pid 15679:tid 15681] [client 185.132.187.156:56943] [client 185.132.187.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/WordPressCore/include.php"] [unique_id "ag_7Yyh8tgGc38WJ-GwIDQAAAMA"]
[Fri May 22 14:44:51.851609 2026] [:error] [pid 58813:tid 58826] [client 82.197.193.251:23137] [client 82.197.193.251] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/dummyyummy/wp-signup.php"] [unique_id "ag_7Y56yyKWDKULhxJ1UmQAAAUo"]
[Fri May 22 14:44:52.812759 2026] [:error] [pid 15679:tid 15696] [client 185.132.187.235:30275] [client 185.132.187.235] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/dzs-zoomsounds/1877.php"] [unique_id "ag_7ZCh8tgGc38WJ-GwIDgAAAM8"]
[Fri May 22 14:44:53.660676 2026] [:error] [pid 15679:tid 15692] [client 185.132.187.41:41677] [client 185.132.187.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/core-plugin/include.php"] [unique_id "ag_7ZSh8tgGc38WJ-GwIDwAAAMs"]
[Fri May 22 14:44:54.502277 2026] [:error] [pid 15679:tid 15687] [client 185.132.187.41:53031] [client 185.132.187.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/linkpreview/index.php"] [unique_id "ag_7Zih8tgGc38WJ-GwIEQAAAMY"]
[Fri May 22 14:44:55.364504 2026] [:error] [pid 58813:tid 58824] [client 185.132.187.156:52473] [client 185.132.187.156] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/linkpreview/db.php"] [unique_id "ag_7Z56yyKWDKULhxJ1UnQAAAUg"]
[Fri May 22 14:44:56.216459 2026] [:error] [pid 58813:tid 58830] [client 185.132.187.174:57375] [client 185.132.187.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/seoplugins/db.php"] [unique_id "ag_7aJ6yyKWDKULhxJ1UoAAAAU4"]
[Fri May 22 14:44:57.086168 2026] [:error] [pid 15679:tid 15700] [client 185.132.187.102:24727] [client 185.132.187.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/aatdgetgdg/main.php"] [unique_id "ag_7aSh8tgGc38WJ-GwIFgAAANM"]
[Fri May 22 14:44:57.956605 2026] [:error] [pid 15585:tid 15668] [client 185.132.187.96:54353] [client 185.132.187.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/init-help/init.php"] [unique_id "ag_7aSKb-vB41AF-LC0UVgAAAJU"]
[Fri May 22 14:44:58.800724 2026] [:error] [pid 15584:tid 15620] [client 82.197.193.136:52035] [client 82.197.193.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/seoplugins/mar.php"] [unique_id "ag_7at9Z_TVLbNEx52jtzAAAAEA"]
[Fri May 22 14:44:59.651035 2026] [:error] [pid 58813:tid 58822] [client 82.197.193.199:27207] [client 82.197.193.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/press/wp-class.php"] [unique_id "ag_7a56yyKWDKULhxJ1UpQAAAUY"]
[Fri May 22 14:45:00.565772 2026] [:error] [pid 15584:tid 15624] [client 185.132.187.236:54397] [client 185.132.187.236] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/coffee/index.php"] [unique_id "ag_7bN9Z_TVLbNEx52jtzQAAAEQ"]
[Fri May 22 14:45:01.489999 2026] [:error] [pid 58782:tid 58788] [client 185.132.187.240:22647] [client 185.132.187.240] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/schema/geckos.php"] [unique_id "ag_7bYxsdTFafgO8vhT6MgAAAQQ"]
[Fri May 22 14:45:02.340060 2026] [:error] [pid 15584:tid 15642] [client 185.132.187.203:57139] [client 185.132.187.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/5PJcpMFsD8B.php"] [unique_id "ag_7bt9Z_TVLbNEx52jt0QAAAFY"]
[Fri May 22 14:45:03.217503 2026] [:error] [pid 15679:tid 15681] [client 185.132.187.238:35899] [client 185.132.187.238] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/bltm/wp-login.php"] [unique_id "ag_7byh8tgGc38WJ-GwIHQAAAMA"]
[Fri May 22 14:45:04.175303 2026] [:error] [pid 15679:tid 15700] [client 185.132.187.251:32911] [client 185.132.187.251] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfour/patterns/template-singl-portfolio.php"] [unique_id "ag_7cCh8tgGc38WJ-GwIHgAAANM"]
[Fri May 22 14:45:05.026729 2026] [:error] [pid 58782:tid 58784] [client 185.132.187.156:21669] [client 185.132.187.156] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/filemanager.php"] [unique_id "ag_7cYxsdTFafgO8vhT6NwAAAQA"]
[Fri May 22 14:45:05.923344 2026] [:error] [pid 15679:tid 15691] [client 185.132.187.177:62747] [client 185.132.187.177] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/seotheme/db.php"] [unique_id "ag_7cSh8tgGc38WJ-GwIIAAAAMo"]
[Fri May 22 14:45:06.778975 2026] [:error] [pid 15585:tid 15659] [client 185.132.187.242:29999] [client 185.132.187.242] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twenty/twenty.php"] [unique_id "ag_7ciKb-vB41AF-LC0UbQAAAIw"]
[Fri May 22 14:45:07.775148 2026] [:error] [pid 15585:tid 15656] [client 185.132.187.236:48393] [client 185.132.187.236] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd-1/pwnd.php"] [unique_id "ag_7cyKb-vB41AF-LC0UcAAAAIk"]
[Fri May 22 14:45:08.626838 2026] [:error] [pid 58813:tid 58838] [client 185.132.187.230:38627] [client 185.132.187.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/fonts/fonts.php"] [unique_id "ag_7dJ6yyKWDKULhxJ1UrQAAAVY"]
[Fri May 22 14:45:09.472368 2026] [:error] [pid 15584:tid 15629] [client 82.197.193.14:59217] [client 82.197.193.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/Cache/Cache.php"] [unique_id "ag_7dd9Z_TVLbNEx52jt0gAAAEk"]
[Fri May 22 14:45:10.322350 2026] [:error] [pid 15679:tid 15681] [client 185.132.187.251:28011] [client 185.132.187.251] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/calmly/issue.php"] [unique_id "ag_7dih8tgGc38WJ-GwIJwAAAMA"]
[Fri May 22 14:45:12.691037 2026] [:error] [pid 15679:tid 15692] [client 185.132.187.174:41401] [client 185.132.187.174] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/pridmag/db.php"] [unique_id "ag_7eCh8tgGc38WJ-GwILwAAAMs"]
[Fri May 22 14:45:15.058275 2026] [:error] [pid 58813:tid 58839] [client 82.197.193.215:48459] [client 82.197.193.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/shell/noimg.php"] [unique_id "ag_7e56yyKWDKULhxJ1UsAAAAVc"]
[Fri May 22 14:45:15.918336 2026] [:error] [pid 15584:tid 15626] [client 185.132.187.230:62453] [client 185.132.187.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd-2/pwnd.php"] [unique_id "ag_7e99Z_TVLbNEx52jt2gAAAEY"]
[Fri May 22 14:45:16.798442 2026] [:error] [pid 58813:tid 58819] [client 185.132.187.218:35905] [client 185.132.187.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/schema/yanz.php"] [unique_id "ag_7fJ6yyKWDKULhxJ1UsQAAAUM"]
[Fri May 22 14:45:17.642166 2026] [:error] [pid 15584:tid 15629] [client 185.132.187.49:39673] [client 185.132.187.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/aahana/json.php"] [unique_id "ag_7fd9Z_TVLbNEx52jt3wAAAEk"]
[Fri May 22 14:45:18.510796 2026] [:error] [pid 15584:tid 15639] [client 185.132.187.150:32267] [client 185.132.187.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/TOPXOH/wDR.php"] [unique_id "ag_7ft9Z_TVLbNEx52jt4wAAAFM"]
[Fri May 22 14:45:19.370984 2026] [:error] [pid 15584:tid 15640] [client 185.132.187.238:40729] [client 185.132.187.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pwnd/pwnd.php"] [unique_id "ag_7f99Z_TVLbNEx52jt5wAAAFQ"]
[Fri May 22 14:45:20.261841 2026] [:error] [pid 58813:tid 58817] [client 82.197.193.215:38745] [client 82.197.193.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/Divi/404.php"] [unique_id "ag_7gJ6yyKWDKULhxJ1UvQAAAUE"]
[Fri May 22 14:45:21.109811 2026] [:error] [pid 58813:tid 58837] [client 82.197.193.14:55249] [client 82.197.193.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/ubh/ubh.php"] [unique_id "ag_7gZ6yyKWDKULhxJ1UvwAAAVU"]
[Fri May 22 14:45:21.955353 2026] [:error] [pid 58813:tid 58834] [client 185.132.187.251:62079] [client 185.132.187.251] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/classwithtostring.php"] [unique_id "ag_7gZ6yyKWDKULhxJ1UwQAAAVI"]
[Fri May 22 14:45:22.813884 2026] [:error] [pid 15584:tid 15631] [client 185.132.187.240:59633] [client 185.132.187.240] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/fix/up.php"] [unique_id "ag_7gt9Z_TVLbNEx52jt7gAAAEs"]
[Fri May 22 14:45:23.708755 2026] [:error] [pid 15584:tid 15630] [client 185.132.187.204:34325] [client 185.132.187.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/about.php"] [unique_id "ag_7g99Z_TVLbNEx52jt8AAAAEo"]
[Fri May 22 14:45:24.551838 2026] [:error] [pid 58813:tid 58825] [client 82.197.193.49:62163] [client 82.197.193.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hello.php"] [unique_id "ag_7hJ6yyKWDKULhxJ1UyAAAAUk"]
[Fri May 22 14:45:25.397859 2026] [:error] [pid 15584:tid 15620] [client 82.197.193.81:60237] [client 82.197.193.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/index.php"] [unique_id "ag_7hd9Z_TVLbNEx52jt8wAAAEA"]
[Fri May 22 14:45:26.262119 2026] [:error] [pid 15584:tid 15625] [client 185.132.187.230:53253] [client 185.132.187.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "ag_7ht9Z_TVLbNEx52jt9AAAAEU"]
[Fri May 22 14:45:27.106121 2026] [:error] [pid 58782:tid 58785] [client 82.197.193.190:34443] [client 82.197.193.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/index.php"] [unique_id "ag_7h4xsdTFafgO8vhT6QwAAAQE"]
[Fri May 22 14:45:28.024120 2026] [:error] [pid 58782:tid 58808] [client 185.132.187.165:51837] [client 185.132.187.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/admin.php"] [unique_id "ag_7iIxsdTFafgO8vhT6RwAAARg"]
[Fri May 22 14:45:28.906268 2026] [:error] [pid 15585:tid 15657] [client 82.197.193.136:55107] [client 82.197.193.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/about.php"] [unique_id "ag_7iCKb-vB41AF-LC0UeQAAAIo"]
[Fri May 22 14:45:29.750759 2026] [:error] [pid 15585:tid 15665] [client 82.197.193.49:40501] [client 82.197.193.49] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/index.php"] [unique_id "ag_7iSKb-vB41AF-LC0UfAAAAJI"]
[Fri May 22 14:45:30.613898 2026] [:error] [pid 58813:tid 58835] [client 82.197.193.232:35389] [client 82.197.193.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/index.php"] [unique_id "ag_7ip6yyKWDKULhxJ1UzQAAAVM"]
[Fri May 22 14:45:31.459616 2026] [:error] [pid 15679:tid 15693] [client 82.197.193.190:23145] [client 82.197.193.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/images/index.php"] [unique_id "ag_7iyh8tgGc38WJ-GwINQAAAMw"]
[Fri May 22 14:45:32.311197 2026] [:error] [pid 15585:tid 15653] [client 185.132.187.236:36661] [client 185.132.187.236] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/.well-known/dropdown.php"] [unique_id "ag_7jCKb-vB41AF-LC0UgwAAAIY"]
[Fri May 22 14:45:33.154891 2026] [:error] [pid 15679:tid 15685] [client 185.132.187.44:32753] [client 185.132.187.44] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/index.php"] [unique_id "ag_7jSh8tgGc38WJ-GwINgAAAMQ"]
[Fri May 22 14:45:34.019829 2026] [:error] [pid 15585:tid 15663] [client 185.132.187.158:58979] [client 185.132.187.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/about.php"] [unique_id "ag_7jiKb-vB41AF-LC0UigAAAJA"]
[Fri May 22 14:45:36.463485 2026] [:error] [pid 15583:tid 15588] [client 82.197.193.14:23971] [client 82.197.193.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/index.php"] [unique_id "ag_7kHnaOncRcIm17YXb3gAAAAA"]
[Fri May 22 14:45:37.383005 2026] [:error] [pid 15585:tid 15668] [client 82.197.193.251:50225] [client 82.197.193.251] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/index.php"] [unique_id "ag_7kSKb-vB41AF-LC0UjgAAAJU"]
[Fri May 22 14:45:38.252286 2026] [:error] [pid 15584:tid 15638] [client 185.132.187.240:63705] [client 185.132.187.240] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/classwithtostring.php"] [unique_id "ag_7kt9Z_TVLbNEx52jt_QAAAFI"]
[Fri May 22 14:45:39.092318 2026] [:error] [pid 15585:tid 15664] [client 82.197.193.190:52303] [client 82.197.193.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/dropdown.php"] [unique_id "ag_7kyKb-vB41AF-LC0UkQAAAJE"]
[Fri May 22 14:45:39.946890 2026] [:error] [pid 15585:tid 15648] [client 185.132.187.235:64815] [client 185.132.187.235] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/autoload_classmap.php"] [unique_id "ag_7kyKb-vB41AF-LC0UlAAAAIE"]
[Fri May 22 14:45:40.782057 2026] [:error] [pid 15585:tid 15652] [client 82.197.193.78:60359] [client 82.197.193.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/index.php"] [unique_id "ag_7lCKb-vB41AF-LC0UlwAAAIU"]
[Fri May 22 14:45:41.640306 2026] [:error] [pid 15584:tid 15641] [client 82.197.193.143:58209] [client 82.197.193.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/.well-known/index.php"] [unique_id "ag_7ld9Z_TVLbNEx52jt_wAAAFU"]
[Fri May 22 14:45:42.490508 2026] [:error] [pid 15585:tid 15663] [client 185.132.187.150:56169] [client 185.132.187.150] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/index.php"] [unique_id "ag_7liKb-vB41AF-LC0UnAAAAJA"]
[Fri May 22 14:45:43.378948 2026] [:error] [pid 15679:tid 15686] [client 82.197.193.145:52101] [client 82.197.193.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/fmadmin.php"] [unique_id "ag_7lyh8tgGc38WJ-GwIQAAAAMU"]
[Fri May 22 14:45:44.245524 2026] [:error] [pid 15584:tid 15643] [client 82.197.193.78:51989] [client 82.197.193.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/admin.php"] [unique_id "ag_7mN9Z_TVLbNEx52juAQAAAFc"]
[Fri May 22 14:45:45.100963 2026] [:error] [pid 15584:tid 15625] [client 185.132.187.41:63441] [client 185.132.187.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/options.php"] [unique_id "ag_7md9Z_TVLbNEx52juAwAAAEU"]
[Fri May 22 14:45:45.958428 2026] [:error] [pid 15585:tid 15664] [client 185.132.187.150:62949] [client 185.132.187.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/index.php"] [unique_id "ag_7mSKb-vB41AF-LC0UoQAAAJE"]
[Fri May 22 14:45:46.839880 2026] [:error] [pid 15584:tid 15622] [client 185.132.187.100:36079] [client 185.132.187.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/about.php"] [unique_id "ag_7mt9Z_TVLbNEx52juCAAAAEI"]
[Fri May 22 14:45:47.729348 2026] [:error] [pid 15584:tid 15630] [client 185.132.187.165:25785] [client 185.132.187.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/mah/function.php"] [unique_id "ag_7m99Z_TVLbNEx52juCQAAAEo"]
[Fri May 22 14:45:48.613347 2026] [:error] [pid 15584:tid 15621] [client 185.132.187.44:23665] [client 185.132.187.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/3PJcpMFsD8B.php"] [unique_id "ag_7nN9Z_TVLbNEx52juCwAAAEE"]
[Fri May 22 14:45:49.469537 2026] [:error] [pid 15583:tid 15597] [client 82.197.193.190:38947] [client 82.197.193.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/function.php"] [unique_id "ag_7nXnaOncRcIm17YXb4QAAAAk"]
[Fri May 22 14:45:50.368079 2026] [:error] [pid 15585:tid 15662] [client 82.197.193.14:38211] [client 82.197.193.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin.php"] [unique_id "ag_7niKb-vB41AF-LC0UqAAAAI8"]
[Fri May 22 14:45:51.228160 2026] [:error] [pid 15583:tid 15609] [client 185.132.187.175:32897] [client 185.132.187.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/dropdown.php"] [unique_id "ag_7n3naOncRcIm17YXb4gAAABU"]
[Fri May 22 14:45:52.088680 2026] [:error] [pid 15679:tid 15695] [client 185.132.187.102:46405] [client 185.132.187.102] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/content.php"] [unique_id "ag_7oCh8tgGc38WJ-GwIRAAAAM4"]
[Fri May 22 14:45:52.924526 2026] [:error] [pid 15583:tid 15601] [client 82.197.193.95:34957] [client 82.197.193.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/default.php"] [unique_id "ag_7oHnaOncRcIm17YXb4wAAAA0"]
[Fri May 22 14:45:53.782315 2026] [:error] [pid 58813:tid 58839] [client 185.132.187.219:55981] [client 185.132.187.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/bypass.php"] [unique_id "ag_7oZ6yyKWDKULhxJ1U2gAAAVc"]
[Fri May 22 14:45:54.642220 2026] [:error] [pid 15679:tid 15699] [client 82.197.193.232:35469] [client 82.197.193.232] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/inputs.php"] [unique_id "ag_7oih8tgGc38WJ-GwITAAAANI"]
[Fri May 22 14:45:55.496157 2026] [:error] [pid 15679:tid 15686] [client 185.132.187.215:46695] [client 185.132.187.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/chosen.php"] [unique_id "ag_7oyh8tgGc38WJ-GwITwAAAMU"]
[Fri May 22 14:45:56.334581 2026] [:error] [pid 58782:tid 58798] [client 185.132.187.158:49573] [client 185.132.187.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/simple.php"] [unique_id "ag_7pIxsdTFafgO8vhT6VQAAAQ4"]
[Fri May 22 14:45:57.430126 2026] [:error] [pid 15679:tid 15705] [client 82.197.193.95:51769] [client 82.197.193.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/file2.php"] [unique_id "ag_7pSh8tgGc38WJ-GwIVQAAANg"]
[Fri May 22 14:45:58.297589 2026] [:error] [pid 15584:tid 15641] [client 185.132.187.238:51799] [client 185.132.187.238] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/themes.php"] [unique_id "ag_7pt9Z_TVLbNEx52juDgAAAFU"]
[Fri May 22 14:45:59.189942 2026] [:error] [pid 15584:tid 15637] [client 82.197.193.98:31517] [client 82.197.193.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/config.php"] [unique_id "ag_7p99Z_TVLbNEx52juDwAAAFE"]
[Fri May 22 14:46:00.060174 2026] [:error] [pid 15584:tid 15639] [client 82.197.193.81:41125] [client 82.197.193.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/style.php"] [unique_id "ag_7qN9Z_TVLbNEx52juEAAAAFM"]
[Fri May 22 14:46:00.915978 2026] [:error] [pid 15583:tid 15608] [client 82.197.193.60:44547] [client 82.197.193.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/style2.php"] [unique_id "ag_7qHnaOncRcIm17YXb5AAAABQ"]
[Fri May 22 14:46:01.757866 2026] [:error] [pid 15585:tid 15665] [client 82.197.193.199:64349] [client 82.197.193.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/about.php"] [unique_id "ag_7qSKb-vB41AF-LC0UrAAAAJI"]
[Fri May 22 14:46:02.596530 2026] [:error] [pid 15679:tid 15695] [client 185.132.187.203:44211] [client 185.132.187.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/xleet.php"] [unique_id "ag_7qih8tgGc38WJ-GwIWgAAAM4"]
[Fri May 22 14:46:03.466956 2026] [:error] [pid 15584:tid 15642] [client 82.197.193.98:59437] [client 82.197.193.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/login.php"] [unique_id "ag_7q99Z_TVLbNEx52juEgAAAFY"]
[Fri May 22 14:46:04.327769 2026] [:error] [pid 15583:tid 15604] [client 82.197.193.95:27815] [client 82.197.193.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/gel4y.php"] [unique_id "ag_7rHnaOncRcIm17YXb5wAAABA"]
[Fri May 22 14:46:05.187449 2026] [:error] [pid 15583:tid 15596] [client 82.197.193.205:35881] [client 82.197.193.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/admin.php"] [unique_id "ag_7rXnaOncRcIm17YXb6gAAAAg"]
[Fri May 22 14:46:06.033130 2026] [:error] [pid 58813:tid 58829] [client 185.132.187.41:31847] [client 185.132.187.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/radio.php"] [unique_id "ag_7rp6yyKWDKULhxJ1U5wAAAU0"]
[Fri May 22 14:46:06.882554 2026] [:error] [pid 15679:tid 15686] [client 82.197.193.60:21745] [client 82.197.193.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/demo.php"] [unique_id "ag_7rih8tgGc38WJ-GwIXgAAAMU"]
[Fri May 22 14:46:07.741975 2026] [:error] [pid 15679:tid 15693] [client 82.197.193.14:54837] [client 82.197.193.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/moon.php"] [unique_id "ag_7ryh8tgGc38WJ-GwIXwAAAMw"]
[Fri May 22 14:46:08.694790 2026] [:error] [pid 58813:tid 58818] [client 82.197.193.190:55863] [client 82.197.193.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/link.php"] [unique_id "ag_7sJ6yyKWDKULhxJ1U6AAAAUI"]
[Fri May 22 14:46:09.583754 2026] [:error] [pid 15585:tid 15669] [client 185.132.187.96:63731] [client 185.132.187.96] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "ag_7sSKb-vB41AF-LC0UrwAAAJY"]
[Fri May 22 14:46:10.446498 2026] [:error] [pid 15584:tid 15640] [client 185.132.187.251:55255] [client 185.132.187.251] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/user.php"] [unique_id "ag_7st9Z_TVLbNEx52juGAAAAFQ"]
[Fri May 22 14:46:11.293067 2026] [:error] [pid 15679:tid 15696] [client 185.132.187.152:47883] [client 185.132.187.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/menu.php"] [unique_id "ag_7syh8tgGc38WJ-GwIYQAAAM8"]
[Fri May 22 14:46:12.135609 2026] [:error] [pid 58782:tid 58793] [client 185.132.187.150:44241] [client 185.132.187.150] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/alfa.php"] [unique_id "ag_7tIxsdTFafgO8vhT6WgAAAQk"]
[Fri May 22 14:46:12.977784 2026] [:error] [pid 15679:tid 15704] [client 185.132.187.240:22365] [client 185.132.187.240] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/file.php"] [unique_id "ag_7tCh8tgGc38WJ-GwIcQAAANc"]
[Fri May 22 14:46:13.868651 2026] [:error] [pid 15679:tid 15686] [client 185.132.187.49:29445] [client 185.132.187.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/mini.php"] [unique_id "ag_7tSh8tgGc38WJ-GwIdAAAAMU"]
[Fri May 22 14:46:14.764858 2026] [:error] [pid 58782:tid 58797] [client 185.132.187.204:50047] [client 185.132.187.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/info.php"] [unique_id "ag_7toxsdTFafgO8vhT6XAAAAQ0"]
[Fri May 22 14:46:15.601007 2026] [:error] [pid 15583:tid 15596] [client 185.132.187.152:61537] [client 185.132.187.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/log.php"] [unique_id "ag_7t3naOncRcIm17YXb8wAAAAg"]
[Fri May 22 14:46:16.833724 2026] [:error] [pid 58813:tid 58821] [client 82.197.193.81:37577] [client 82.197.193.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wso.php"] [unique_id "ag_7uJ6yyKWDKULhxJ1U7wAAAUU"]
[Fri May 22 14:46:17.656582 2026] [:error] [pid 58813:tid 58818] [client 82.197.193.251:48251] [client 82.197.193.251] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/modules/scrollbottom/anamama-2.php"] [unique_id "ag_7uZ6yyKWDKULhxJ1U8QAAAUI"]
[Fri May 22 14:46:18.474623 2026] [:error] [pid 15679:tid 15686] [client 185.132.187.230:28847] [client 185.132.187.230] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/modules/mod_simplefileuploadv1.3/elements/filemanager.php"] [unique_id "ag_7uih8tgGc38WJ-GwIeQAAAMU"]
[Fri May 22 14:46:19.290169 2026] [:error] [pid 15585:tid 15662] [client 185.132.187.203:36919] [client 185.132.187.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/403.php"] [unique_id "ag_7uyKb-vB41AF-LC0UuAAAAI8"]
[Fri May 22 14:46:20.133746 2026] [:error] [pid 15584:tid 15640] [client 185.132.187.238:64741] [client 185.132.187.238] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/doc.php"] [unique_id "ag_7vN9Z_TVLbNEx52juHwAAAFQ"]
[Fri May 22 14:46:20.974743 2026] [:error] [pid 15679:tid 15689] [client 82.197.193.81:24859] [client 82.197.193.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/404.php"] [unique_id "ag_7vCh8tgGc38WJ-GwIegAAAMg"]
[Fri May 22 14:46:21.806770 2026] [:error] [pid 58813:tid 58819] [client 185.132.187.41:51863] [client 185.132.187.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/mah.php"] [unique_id "ag_7vZ6yyKWDKULhxJ1U9QAAAUM"]
[Fri May 22 14:46:22.686456 2026] [:error] [pid 58782:tid 58791] [client 185.132.187.49:29607] [client 185.132.187.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp.php"] [unique_id "ag_7voxsdTFafgO8vhT6ZQAAAQc"]
[Fri May 22 14:46:23.524568 2026] [:error] [pid 58782:tid 58797] [client 82.197.193.153:38783] [client 82.197.193.153] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/fm.php"] [unique_id "ag_7v4xsdTFafgO8vhT6ZwAAAQ0"]
[Fri May 22 14:46:24.386363 2026] [:error] [pid 15583:tid 15591] [client 82.197.193.205:59309] [client 82.197.193.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/1.php"] [unique_id "ag_7wHnaOncRcIm17YXb_gAAAAM"]
[Fri May 22 14:46:25.252769 2026] [:error] [pid 15583:tid 15599] [client 185.132.187.218:61223] [client 185.132.187.218] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/a.php"] [unique_id "ag_7wXnaOncRcIm17YXcAQAAAAs"]
[Fri May 22 14:46:26.075432 2026] [:error] [pid 15679:tid 15704] [client 82.197.193.199:32619] [client 82.197.193.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/m.php"] [unique_id "ag_7wih8tgGc38WJ-GwIfAAAANc"]
[Fri May 22 14:46:26.925636 2026] [:error] [pid 15679:tid 15695] [client 185.132.187.158:20333] [client 185.132.187.158] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/modules/ets_whatsapp/security.php"] [unique_id "ag_7wih8tgGc38WJ-GwIfgAAAM4"]
[Fri May 22 14:46:27.786749 2026] [:error] [pid 15585:tid 15661] [client 185.132.187.215:61631] [client 185.132.187.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/templates/beez/index.php"] [unique_id "ag_7wyKb-vB41AF-LC0UugAAAI4"]
[Fri May 22 14:46:28.614188 2026] [:error] [pid 15679:tid 15692] [client 185.132.187.44:38183] [client 185.132.187.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/templates/beez3/index.php"] [unique_id "ag_7xCh8tgGc38WJ-GwIggAAAMs"]
[Fri May 22 14:46:29.440777 2026] [:error] [pid 15679:tid 15689] [client 185.132.187.236:54641] [client 185.132.187.236] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/templates/protostar/error.php"] [unique_id "ag_7xSh8tgGc38WJ-GwIhQAAAMg"]
[Fri May 22 14:46:30.262930 2026] [:error] [pid 15679:tid 15704] [client 82.197.193.31:64467] [client 82.197.193.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/templates/beez3/error.php"] [unique_id "ag_7xih8tgGc38WJ-GwIiAAAANc"]
[Fri May 22 14:46:31.093668 2026] [:error] [pid 15679:tid 15686] [client 185.132.187.96:36611] [client 185.132.187.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/templates/beez3/jsstrings.php"] [unique_id "ag_7xyh8tgGc38WJ-GwIigAAAMU"]
[Fri May 22 14:46:31.952061 2026] [:error] [pid 15584:tid 15627] [client 185.132.187.175:24781] [client 185.132.187.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/templates/atomic/index.php"] [unique_id "ag_7x99Z_TVLbNEx52juKAAAAEc"]
[Fri May 22 14:46:32.857978 2026] [:error] [pid 15679:tid 15686] [client 82.197.193.246:30693] [client 82.197.193.246] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/templates/cassiopeia/error.php"] [unique_id "ag_7yCh8tgGc38WJ-GwIkAAAAMU"]
[Fri May 22 14:46:33.685758 2026] [:error] [pid 15679:tid 15690] [client 185.132.187.204:55559] [client 185.132.187.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/templates/ja_purity/index.php"] [unique_id "ag_7ySh8tgGc38WJ-GwIlAAAAMk"]
[Fri May 22 14:46:34.508826 2026] [:error] [pid 15585:tid 15669] [client 185.132.187.232:23215] [client 185.132.187.232] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/bypas.php"] [unique_id "ag_7yiKb-vB41AF-LC0UuwAAAJY"]
[Fri May 22 14:46:35.343270 2026] [:error] [pid 15585:tid 15657] [client 185.132.187.238:36809] [client 185.132.187.238] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/license.php"] [unique_id "ag_7yyKb-vB41AF-LC0UvwAAAIo"]
[Fri May 22 14:46:36.176341 2026] [:error] [pid 15585:tid 15649] [client 185.132.187.242:44833] [client 185.132.187.242] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/ateprivacy-policy-guide.php"] [unique_id "ag_7zCKb-vB41AF-LC0UwwAAAII"]
[Fri May 22 14:46:37.000868 2026] [:error] [pid 15585:tid 15664] [client 82.197.193.136:28117] [client 82.197.193.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/news-portal/error.php"] [unique_id "ag_7zCKb-vB41AF-LC0UxwAAAJE"]
[Fri May 22 14:46:37.823915 2026] [:error] [pid 15585:tid 15662] [client 82.197.193.232:40161] [client 82.197.193.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "ag_7zSKb-vB41AF-LC0UyAAAAI8"]
[Fri May 22 14:46:38.675601 2026] [:error] [pid 15679:tid 15682] [client 82.197.193.246:63857] [client 82.197.193.246] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/core/core.php"] [unique_id "ag_7zih8tgGc38WJ-GwImQAAAME"]
[Fri May 22 14:46:39.505459 2026] [:error] [pid 58782:tid 58794] [client 185.132.187.175:34065] [client 185.132.187.175] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/news-portal/sitebar.php"] [unique_id "ag_7z4xsdTFafgO8vhT6dgAAAQo"]
[Fri May 22 14:46:40.322902 2026] [:error] [pid 15584:tid 15639] [client 82.197.193.136:52613] [client 82.197.193.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/elementor/index.php"] [unique_id "ag_70N9Z_TVLbNEx52juMQAAAFM"]
[Fri May 22 14:46:41.146730 2026] [:error] [pid 15584:tid 15643] [client 82.197.193.81:44177] [client 82.197.193.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/StylePlugin/up.php"] [unique_id "ag_70d9Z_TVLbNEx52juNAAAAFc"]
[Fri May 22 14:46:42.003432 2026] [:error] [pid 15585:tid 15670] [client 185.132.187.43:28247] [client 185.132.187.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-cache-sys/index.php"] [unique_id "ag_70iKb-vB41AF-LC0UzAAAAJc"]
[Fri May 22 14:46:42.841224 2026] [:error] [pid 15584:tid 15642] [client 185.132.187.203:42757] [client 185.132.187.203] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/mrx404/upp.php"] [unique_id "ag_70t9Z_TVLbNEx52juOAAAAFY"]
[Fri May 22 14:46:43.680953 2026] [:error] [pid 58813:tid 58827] [client 185.132.187.238:28295] [client 185.132.187.238] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/filester/assets/css/404.php"] [unique_id "ag_7056yyKWDKULhxJ1U-QAAAUs"]
[Fri May 22 14:46:44.509950 2026] [:error] [pid 15679:tid 15683] [client 185.132.187.44:35301] [client 185.132.187.44] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/shell/index.php"] [unique_id "ag_71Ch8tgGc38WJ-GwIoAAAAMI"]
[Fri May 22 14:46:45.355598 2026] [:error] [pid 15584:tid 15634] [client 82.197.193.191:31853] [client 82.197.193.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/template-singl-portfolio.php"] [unique_id "ag_71d9Z_TVLbNEx52juPAAAAE4"]
[Fri May 22 14:46:46.173041 2026] [:error] [pid 15584:tid 15643] [client 82.197.193.136:20343] [client 82.197.193.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wordpress-seo/admin/metabox/about.php"] [unique_id "ag_71t9Z_TVLbNEx52juPQAAAFc"]
[Fri May 22 14:46:47.000452 2026] [:error] [pid 15584:tid 15631] [client 185.132.187.100:39415] [client 185.132.187.100] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wordpress-seo/src/dashboard/application/search-rankings/about.php"] [unique_id "ag_71t9Z_TVLbNEx52juQgAAAEs"]
[Fri May 22 14:46:47.857112 2026] [:error] [pid 15584:tid 15636] [client 82.197.193.199:58683] [client 82.197.193.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/Iitespeed-cache/classwithtostring.php"] [unique_id "ag_7199Z_TVLbNEx52juRAAAAFA"]
[Fri May 22 14:46:48.687274 2026] [:error] [pid 15679:tid 15702] [client 82.197.193.60:34707] [client 82.197.193.60] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/elementor/core/files/about.php"] [unique_id "ag_72Ch8tgGc38WJ-GwIpgAAANU"]
[Fri May 22 14:46:49.559024 2026] [:error] [pid 15584:tid 15634] [client 82.197.193.232:59285] [client 82.197.193.232] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/elementor/includes/interfaces/about.php"] [unique_id "ag_72d9Z_TVLbNEx52juRQAAAE4"]
[Fri May 22 14:46:50.392874 2026] [:error] [pid 15584:tid 15643] [client 82.197.193.145:32473] [client 82.197.193.145] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/waspthemes-yellow-pencil/images/list/about.php"] [unique_id "ag_72t9Z_TVLbNEx52juRgAAAFc"]
[Fri May 22 14:46:51.249296 2026] [:error] [pid 58813:tid 58834] [client 185.132.187.41:26315] [client 185.132.187.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/woocommerce/includes/import/about.php"] [unique_id "ag_7256yyKWDKULhxJ1U-wAAAVI"]
[Fri May 22 14:46:52.088007 2026] [:error] [pid 15585:tid 15659] [client 185.132.187.219:52683] [client 185.132.187.219] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/miniorange-malware-protection/handler/about.php"] [unique_id "ag_73CKb-vB41AF-LC0U0wAAAIw"]
[Fri May 22 14:46:52.912225 2026] [:error] [pid 15585:tid 15662] [client 82.197.193.81:37645] [client 82.197.193.81] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/mtodm/index.php"] [unique_id "ag_73CKb-vB41AF-LC0U1QAAAI8"]
[Fri May 22 14:46:53.732644 2026] [:error] [pid 15584:tid 15623] [client 82.197.193.49:37689] [client 82.197.193.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/elementor/modules/atomic-widgets/prop-types/transform/lock.php"] [unique_id "ag_73d9Z_TVLbNEx52juTQAAAEM"]
[Fri May 22 14:46:54.551148 2026] [:error] [pid 15585:tid 15648] [client 185.132.187.49:47323] [client 185.132.187.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/x/wp-classs-editor.php"] [unique_id "ag_73iKb-vB41AF-LC0U2wAAAIE"]
[Fri May 22 14:46:55.374371 2026] [:error] [pid 15585:tid 15660] [client 185.132.187.204:53591] [client 185.132.187.204] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/elementor-pro/cong.php"] [unique_id "ag_73yKb-vB41AF-LC0U3AAAAI0"]
[Fri May 22 14:46:56.196139 2026] [:error] [pid 15585:tid 15649] [client 185.132.187.151:56369] [client 185.132.187.151] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/pretty-link/js/build/wp-cron.php"] [unique_id "ag_74CKb-vB41AF-LC0U3QAAAII"]
[Fri May 22 14:46:57.045138 2026] [:error] [pid 15584:tid 15639] [client 82.197.193.95:54875] [client 82.197.193.95] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/slideshow-ck/themes/config.php"] [unique_id "ag_74d9Z_TVLbNEx52juUAAAAFM"]
[Fri May 22 14:46:57.886062 2026] [:error] [pid 15584:tid 15635] [client 185.132.187.240:48809] [client 185.132.187.240] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/contact-form-7/includes/js/jquery-ui/themes/system.php"] [unique_id "ag_74d9Z_TVLbNEx52juUwAAAE8"]
[Fri May 22 14:46:58.725565 2026] [:error] [pid 15585:tid 15665] [client 185.132.187.165:53045] [client 185.132.187.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/all-in-one-wp-security-and-firewall/templates/wp-admin/security.php"] [unique_id "ag_74iKb-vB41AF-LC0U4QAAAJI"]
[Fri May 22 14:46:59.568160 2026] [:error] [pid 15584:tid 15636] [client 82.197.193.31:49557] [client 82.197.193.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/contact-form-7/rstsgd.php"] [unique_id "ag_7499Z_TVLbNEx52juVgAAAFA"]
[Fri May 22 14:47:00.390021 2026] [:error] [pid 58813:tid 58828] [client 185.132.187.43:59081] [client 185.132.187.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/shortcodes-ultimate/admin.php"] [unique_id "ag_75J6yyKWDKULhxJ1U_gAAAUw"]
[Fri May 22 14:47:01.207693 2026] [:error] [pid 15583:tid 15597] [client 185.132.187.215:50731] [client 185.132.187.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wordpress-seo/inc/WPSEO.php"] [unique_id "ag_75XnaOncRcIm17YXcFAAAAAk"]
[Fri May 22 14:47:02.041179 2026] [:error] [pid 58813:tid 58833] [client 185.132.187.49:55001] [client 185.132.187.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/woocommerce/includes/admin/reports/class-wc-report-orders-stats.php"] [unique_id "ag_75p6yyKWDKULhxJ1VAAAAAVE"]
[Fri May 22 14:47:02.956663 2026] [:error] [pid 58782:tid 58795] [client 82.197.193.251:41441] [client 82.197.193.251] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/contact-form-7/admin/js/contact-form-7-admin.js.php"] [unique_id "ag_75oxsdTFafgO8vhT6jQAAAQs"]
[Fri May 22 14:47:03.808475 2026] [:error] [pid 15584:tid 15621] [client 185.132.187.215:59021] [client 185.132.187.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/revslider/temp/update_extract/revslider.php"] [unique_id "ag_7599Z_TVLbNEx52juWQAAAEE"]
[Fri May 22 14:47:04.650197 2026] [:error] [pid 15585:tid 15671] [client 82.197.193.190:55437] [client 82.197.193.190] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-file-manager/lib/php/connector.minimal.php"] [unique_id "ag_76CKb-vB41AF-LC0U7QAAAJg"]
[Fri May 22 14:47:05.489831 2026] [:error] [pid 15679:tid 15697] [client 82.197.193.78:42227] [client 82.197.193.78] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyone/template-parts/index.php"] [unique_id "ag_76Sh8tgGc38WJ-GwIwAAAANA"]
[Fri May 22 14:47:06.314557 2026] [:error] [pid 15584:tid 15626] [client 185.132.187.152:63699] [client 185.132.187.152] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfour/patterns/file.php"] [unique_id "ag_76t9Z_TVLbNEx52juXAAAAEY"]
[Fri May 22 14:47:07.136330 2026] [:error] [pid 15679:tid 15702] [client 185.132.187.43:51923] [client 185.132.187.43] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentytwo/assets/fonts/index.php"] [unique_id "ag_76yh8tgGc38WJ-GwIxAAAANU"]
[Fri May 22 14:47:08.301167 2026] [:error] [pid 58813:tid 58818] [client 82.197.193.14:41181] [client 82.197.193.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwenty/assets/fonts/inter/index.php"] [unique_id "ag_77J6yyKWDKULhxJ1VBgAAAUI"]
[Fri May 22 14:47:09.134169 2026] [:error] [pid 15584:tid 15629] [client 185.132.187.49:35673] [client 185.132.187.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentytwo/parts/index.php"] [unique_id "ag_77d9Z_TVLbNEx52juXwAAAEk"]
[Fri May 22 14:47:09.953033 2026] [:error] [pid 58782:tid 58786] [client 82.197.193.232:20299] [client 82.197.193.232] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/chillbud/inc/welcome/assets/img/index.php"] [unique_id "ag_77YxsdTFafgO8vhT6kgAAAQI"]
[Fri May 22 14:47:10.775412 2026] [:error] [pid 15584:tid 15620] [client 185.132.187.49:37685] [client 185.132.187.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/astra/inc/builder/type/base/dynamic-css/button/index.php"] [unique_id "ag_77t9Z_TVLbNEx52juYgAAAEA"]
[Fri May 22 14:47:11.599648 2026] [:error] [pid 15584:tid 15637] [client 82.197.193.205:23521] [client 82.197.193.205] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/neve/assets/apps/dashboard/build/index.php"] [unique_id "ag_7799Z_TVLbNEx52juZAAAAFE"]
[Fri May 22 14:47:12.423452 2026] [:error] [pid 58813:tid 58817] [client 82.197.193.143:48751] [client 82.197.193.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/packed.php"] [unique_id "ag_78J6yyKWDKULhxJ1VCwAAAUE"]
[Fri May 22 14:47:13.282849 2026] [:error] [pid 15584:tid 15636] [client 185.132.187.215:33457] [client 185.132.187.215] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/index.php"] [unique_id "ag_78d9Z_TVLbNEx52juZwAAAFA"]
[Fri May 22 14:47:14.104359 2026] [:error] [pid 58813:tid 58822] [client 185.132.187.41:60361] [client 185.132.187.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wpforms/index.php"] [unique_id "ag_78p6yyKWDKULhxJ1VDQAAAUY"]
[Fri May 22 14:47:14.922279 2026] [:error] [pid 15584:tid 15640] [client 185.132.187.165:63845] [client 185.132.187.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/plugins/admin.php"] [unique_id "ag_78t9Z_TVLbNEx52juaQAAAFQ"]
[Fri May 22 14:47:15.780952 2026] [:error] [pid 15583:tid 15603] [client 82.197.193.153:57653] [client 82.197.193.153] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/themes/index.php"] [unique_id "ag_783naOncRcIm17YXcHAAAAA8"]
[Fri May 22 14:47:16.604879 2026] [:error] [pid 15584:tid 15634] [client 185.132.187.175:25339] [client 185.132.187.175] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/codemirror/config.php"] [unique_id "ag_79N9Z_TVLbNEx52jubAAAAE4"]
[Fri May 22 14:47:17.432341 2026] [:error] [pid 58782:tid 58797] [client 185.132.187.251:39797] [client 185.132.187.251] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/themes/about.php"] [unique_id "ag_79YxsdTFafgO8vhT6mQAAAQ0"]
[Fri May 22 14:47:18.273534 2026] [:error] [pid 15583:tid 15610] [client 82.197.193.136:30219] [client 82.197.193.136] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-bindings/system_core.php"] [unique_id "ag_79nnaOncRcIm17YXcHQAAABY"]
[Fri May 22 14:47:19.095636 2026] [:error] [pid 15583:tid 15601] [client 185.132.187.232:32305] [client 185.132.187.232] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/about.php"] [unique_id "ag_793naOncRcIm17YXcHwAAAA0"]
[Fri May 22 14:47:19.914751 2026] [:error] [pid 58813:tid 58817] [client 185.132.187.238:49857] [client 185.132.187.238] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/namespaced/Core/goods.php"] [unique_id "ag_7956yyKWDKULhxJ1VEwAAAUE"]
[Fri May 22 14:47:20.739464 2026] [:error] [pid 58782:tid 58795] [client 82.197.193.136:46935] [client 82.197.193.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "ag_7-IxsdTFafgO8vhT6ngAAAQs"]
[Fri May 22 14:47:21.569225 2026] [:error] [pid 15583:tid 15599] [client 82.197.193.143:52755] [client 82.197.193.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/wp-conflg.php"] [unique_id "ag_7-XnaOncRcIm17YXcIwAAAAs"]
[Fri May 22 14:47:22.391151 2026] [:error] [pid 58782:tid 58804] [client 82.197.193.98:42659] [client 82.197.193.98] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-config-sample.php"] [unique_id "ag_7-oxsdTFafgO8vhT6nwAAARQ"]
[Fri May 22 14:47:23.214265 2026] [:error] [pid 15583:tid 15589] [client 185.132.187.165:26237] [client 185.132.187.165] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/pwnd-themes/php5-litespeed.php"] [unique_id "ag_7-3naOncRcIm17YXcJQAAAAE"]
[Fri May 22 14:47:24.074604 2026] [:error] [pid 15584:tid 15642] [client 82.197.193.191:36613] [client 82.197.193.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/updraft/emptydir/index.php"] [unique_id "ag_7_N9Z_TVLbNEx52judQAAAFY"]
[Fri May 22 14:47:24.950995 2026] [:error] [pid 15585:tid 15666] [client 185.132.187.96:38049] [client 185.132.187.96] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/rstsgd.php"] [unique_id "ag_7_CKb-vB41AF-LC0U-gAAAJM"]
[Fri May 22 14:47:25.774902 2026] [:error] [pid 15585:tid 15648] [client 82.197.193.49:58059] [client 82.197.193.49] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp-solo/solo.php"] [unique_id "ag_7_SKb-vB41AF-LC0U-wAAAIE"]
[Fri May 22 14:47:26.602053 2026] [:error] [pid 58782:tid 58802] [client 82.197.193.199:52433] [client 82.197.193.199] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/view-source/moon.php"] [unique_id "ag_7_oxsdTFafgO8vhT6oQAAARI"]
[Fri May 22 14:47:27.617403 2026] [:error] [pid 15584:tid 15636] [client 82.197.193.14:31541] [client 82.197.193.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/security_1777619880/caches.php"] [unique_id "ag_7_99Z_TVLbNEx52judwAAAFA"]
[Fri May 22 14:47:28.442930 2026] [:error] [pid 15583:tid 15599] [client 82.197.193.143:28749] [client 82.197.193.143] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/social_1777619877/caches.php"] [unique_id "ag_8AHnaOncRcIm17YXcKAAAAAs"]
[Fri May 22 14:47:29.288571 2026] [:error] [pid 58813:tid 58833] [client 82.197.193.191:63945] [client 82.197.193.191] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/jsonq.php"] [unique_id "ag_8AZ6yyKWDKULhxJ1VGAAAAVE"]
[Fri May 22 14:47:30.122894 2026] [:error] [pid 58813:tid 58830] [client 185.132.187.232:40787] [client 185.132.187.232] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/payment-gateway-pix-for-woocommerce/Includes/files/certs_c6/admin.php"] [unique_id "ag_8Ap6yyKWDKULhxJ1VGQAAAU4"]
[Fri May 22 14:47:31.033909 2026] [:error] [pid 15583:tid 15610] [client 82.197.193.232:59259] [client 82.197.193.232] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/ioxi/ioxi-o2.php"] [unique_id "ag_8A3naOncRcIm17YXcMAAAABY"]
[Fri May 22 14:47:31.876778 2026] [:error] [pid 15585:tid 15665] [client 82.197.193.31:45077] [client 82.197.193.31] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/plugin/uninstall.php"] [unique_id "ag_8AyKb-vB41AF-LC0U_gAAAJI"]
[Fri May 22 14:47:32.707737 2026] [:error] [pid 15584:tid 15633] [client 82.197.193.136:53437] [client 82.197.193.136] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/Shelly/Shelly.php"] [unique_id "ag_8BN9Z_TVLbNEx52jueQAAAE0"]
[Fri May 22 15:22:55.969698 2026] [:error] [pid 15585:tid 15651] [client 77.83.39.186:7306] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com.au|F|2"] [data ".old"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com.au"] [uri "/.git/config.old"] [unique_id "ahAETyKb-vB41AF-LC0hqAAAAIQ"]
[Fri May 22 15:24:14.978881 2026] [:error] [pid 15679:tid 15690] [client 77.83.39.186:43432] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 2). Match of "pmFromFile userdata_wl_extensions" against "TX:extension" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "27"] [id "210730"] [rev "5"] [msg "COMODO WAF: URL file extension is restricted by policy||paramountestate.com.au|F|2"] [data ".tfstate.backup"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "paramountestate.com.au"] [uri "/terraform.tfstate.backup"] [unique_id "ahAEnih8tgGc38WJ-GwUHAAAAMk"]
[Fri May 22 15:25:01.287003 2026] [:error] [pid 15679:tid 15698] [client 77.83.39.186:11322] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/tmui/login.jsp/..;/tmui/locallb/workspace/fileRead.jsp"] [unique_id "ahAEzSh8tgGc38WJ-GwUSAAAANE"]
[Fri May 22 15:25:37.481051 2026] [core:error] [pid 15585:tid 15661] [client 77.83.39.186:63250] AH10244: invalid URI path (/cgi-bin/.%2e/.%2e/.%2e/.%2e/proc/self/environ)
[Fri May 22 15:25:48.450288 2026] [:error] [pid 15585:tid 15647] [client 77.83.39.186:48076] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "ahAE_CKb-vB41AF-LC0ioQAAAIA"]
[Fri May 22 15:25:48.578437 2026] [:error] [pid 15679:tid 15683] [client 77.83.39.186:48102] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/supabase/.env"] [unique_id "ahAE_Ch8tgGc38WJ-GwUfwAAAMI"]
[Fri May 22 15:25:56.003178 2026] [:error] [pid 15585:tid 15658] [client 77.83.39.186:48110] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/public/.env"] [unique_id "ahAFBCKb-vB41AF-LC0ixwAAAIs"]
[Fri May 22 15:26:05.522899 2026] [:error] [pid 58813:tid 58816] [client 77.83.39.186:48092] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/api/.environment"] [unique_id "ahAFDZ6yyKWDKULhxJ1a3gAAAUA"]
[Fri May 22 15:26:13.706624 2026] [:error] [pid 15585:tid 15648] [client 77.83.39.186:21344] [client 77.83.39.186] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/app/config/.env"] [unique_id "ahAFFSKb-vB41AF-LC0i4AAAAIE"]
[Fri May 22 16:42:30.742685 2026] [:error] [pid 15584:tid 15626] [client 185.198.240.195:38663] [client 185.198.240.195] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/buttons.css"] [unique_id "ahAW9t9Z_TVLbNEx52gGUwAAAEY"]
[Fri May 22 17:07:23.572941 2026] [:error] [pid 15585:tid 15670] [client 161.118.202.128:65424] [client 161.118.202.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file-manager/initialize"] [unique_id "ahAcyyKb-vB41AF-LC1HkwAAAJc"]
[Fri May 22 17:07:23.767126 2026] [:error] [pid 15584:tid 15637] [client 161.118.202.128:65497] [client 161.118.202.128] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/file-manager/initialize"] [unique_id "ahAcy99Z_TVLbNEx52gLPAAAAFE"]
[Fri May 22 17:10:11.334635 2026] [:error] [pid 15583:tid 15611] [client 45.131.65.173:40628] [client 45.131.65.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "ahAdc3naOncRcIm17YX1CwAAABc"]
[Fri May 22 17:10:14.060038 2026] [:error] [pid 15585:tid 15668] [client 45.131.65.173:41616] [client 45.131.65.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "ahAddiKb-vB41AF-LC1IpAAAAJU"]
[Fri May 22 17:10:14.286813 2026] [:error] [pid 15679:tid 15684] [client 45.131.65.173:41644] [client 45.131.65.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.local"] [unique_id "ahAddih8tgGc38WJ-GwwKwAAAMM"]
[Fri May 22 17:10:14.287370 2026] [:error] [pid 15585:tid 15654] [client 45.131.65.173:41674] [client 45.131.65.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/backend/.env"] [unique_id "ahAddiKb-vB41AF-LC1IpQAAAIc"]
[Fri May 22 17:10:14.290918 2026] [:error] [pid 15583:tid 15603] [client 45.131.65.173:41690] [client 45.131.65.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/api/.env"] [unique_id "ahAddnnaOncRcIm17YX1DAAAAA8"]
[Fri May 22 17:10:14.291079 2026] [:error] [pid 15584:tid 15638] [client 45.131.65.173:41662] [client 45.131.65.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.development"] [unique_id "ahAddt9Z_TVLbNEx52gLrgAAAFI"]
[Fri May 22 17:10:14.291515 2026] [:error] [pid 15584:tid 15632] [client 45.131.65.173:41650] [client 45.131.65.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env.production"] [unique_id "ahAddt9Z_TVLbNEx52gLrwAAAEw"]
[Fri May 22 17:10:14.291970 2026] [:error] [pid 15679:tid 15695] [client 45.131.65.173:41622] [client 45.131.65.173] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "ahAddih8tgGc38WJ-GwwLAAAAM4"]
[Fri May 22 17:11:07.804635 2026] [:error] [pid 15585:tid 15662] [client 34.93.63.75:59249] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ahAdqyKb-vB41AF-LC1JGwAAAI8"]
[Fri May 22 17:11:08.090695 2026] [:error] [pid 15585:tid 15661] [client 34.93.63.75:60602] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahAdrCKb-vB41AF-LC1JPAAAAI4"]
[Fri May 22 17:11:08.404243 2026] [:error] [pid 15585:tid 15671] [client 34.93.63.75:62340] [client 34.93.63.75] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/feed/"] [unique_id "ahAdrCKb-vB41AF-LC1JWgAAAJg"]
[Fri May 22 20:16:13.775178 2026] [:error] [pid 58782:tid 58807] [client 104.28.248.163:51793] [client 104.28.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/HEAD"] [unique_id "ahBJDYxsdTFafgO8vhQkYwAAARc"]
[Fri May 22 20:16:13.776255 2026] [:error] [pid 15679:tid 15682] [client 104.28.248.163:51800] [client 104.28.248.163] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.git/config"] [unique_id "ahBJDSh8tgGc38WJ-GxY7wAAAME"]
[Sat May 23 00:41:18.922947 2026] [:error] [pid 15583:tid 15607] [client 34.92.51.219:34276] [client 34.92.51.219] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "ahCHLnnaOncRcIm17YVe9wAAABM"]
[Sat May 23 02:54:01.481087 2026] [:error] [pid 15583:tid 15609] [client 34.16.247.130:39578] [client 34.16.247.130] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "ahCmSXnaOncRcIm17YWWogAAABU"]
[Sun May 24 14:27:21.262326 2026] [:error] [pid 2639:tid 2657] [client 191.237.255.78:26795] [client 191.237.255.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ahKaSUzQncQTd0Z0Oe86XgAAARA"]
[Sun May 24 14:28:14.390532 2026] [:error] [pid 49744:tid 49763] [client 191.237.255.78:27587] [client 191.237.255.78] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ahKafjsE5kPdFpUbbHGtBAAAANE"]
[Sun May 24 17:21:13.371520 2026] [:error] [pid 4777:tid 4796] [client 20.210.93.212:5772] [client 20.210.93.212] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.210.93.212, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ahLDCftPctoQOm4w5pNmFwAAAc4"]
[Sun May 24 18:46:58.176011 2026] [:error] [pid 49688:tid 49704] [client 122.172.80.6:27031] [client 122.172.80.6] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 122.172.80.6, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ahLXImYoQ9V6a_4pBsixWAAAAE0"]
[Mon May 25 00:19:31.119014 2026] [:error] [pid 11280:tid 11299] [client 20.195.192.35:23296] [client 20.195.192.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/about.php"] [unique_id "ahMlE4Rn5s7laoSxy1QzLgAAAE4"]
[Mon May 25 00:20:14.948364 2026] [:error] [pid 15835:tid 15847] [client 20.195.192.35:28216] [client 20.195.192.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Engine/about.php"] [unique_id "ahMlPmWbknYlUM9P0qMf2QAAAAo"]
[Mon May 25 00:20:55.300322 2026] [:error] [pid 11368:tid 11378] [client 20.195.192.35:2507] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/security.php"] [unique_id "ahMlZ4fq_sTmmtTKm1VjMgAAAQg"]
[Mon May 25 00:20:58.470710 2026] [:error] [pid 11282:tid 11362] [client 20.195.192.35:20622] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/security.php"] [unique_id "ahMlau0bPyN3C7HZ1R_KNAAAANY"]
[Mon May 25 00:21:00.227961 2026] [:error] [pid 15835:tid 15839] [client 20.195.192.35:2704] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/security.php"] [unique_id "ahMlbGWbknYlUM9P0qMgEgAAAAI"]
[Mon May 25 00:21:01.251761 2026] [:error] [pid 15835:tid 15843] [client 20.195.192.35:25681] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/security.php"] [unique_id "ahMlbWWbknYlUM9P0qMgFwAAAAY"]
[Mon May 25 00:21:02.150561 2026] [:error] [pid 15835:tid 15845] [client 20.195.192.35:33619] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/title.php"] [unique_id "ahMlbmWbknYlUM9P0qMgGgAAAAg"]
[Mon May 25 00:21:04.583067 2026] [:error] [pid 11282:tid 11342] [client 20.195.192.35:38684] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/title.php"] [unique_id "ahMlcO0bPyN3C7HZ1R_KOQAAAMI"]
[Mon May 25 00:21:07.780306 2026] [:error] [pid 15835:tid 15847] [client 20.195.192.35:2735] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/title.php"] [unique_id "ahMlc2WbknYlUM9P0qMgJAAAAAo"]
[Mon May 25 00:21:09.270524 2026] [:error] [pid 11368:tid 11394] [client 20.195.192.35:25679] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/title.php"] [unique_id "ahMldYfq_sTmmtTKm1VjOgAAARg"]
[Mon May 25 00:21:10.297146 2026] [:error] [pid 15835:tid 15860] [client 20.195.192.35:25697] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/N1.php"] [unique_id "ahMldmWbknYlUM9P0qMgKwAAABc"]
[Mon May 25 00:21:11.681848 2026] [:error] [pid 11281:tid 11331] [client 20.195.192.35:10541] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/N1.php"] [unique_id "ahMld5KmC9taWvA91j6nBQAAAJI"]
[Mon May 25 00:21:12.868419 2026] [:error] [pid 11281:tid 11337] [client 20.195.192.35:10520] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/N1.php"] [unique_id "ahMleJKmC9taWvA91j6nCAAAAJg"]
[Mon May 25 00:21:14.141378 2026] [:error] [pid 11368:tid 11384] [client 20.195.192.35:38715] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/N1.php"] [unique_id "ahMleofq_sTmmtTKm1VjQgAAAQ4"]
[Mon May 25 00:21:15.181794 2026] [:error] [pid 15835:tid 15839] [client 20.195.192.35:18428] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/nastar.php"] [unique_id "ahMle2WbknYlUM9P0qMgMgAAAAI"]
[Mon May 25 00:21:15.883879 2026] [:error] [pid 15835:tid 15848] [client 20.195.192.35:18372] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/nastar.php"] [unique_id "ahMle2WbknYlUM9P0qMgNAAAAAs"]
[Mon May 25 00:21:16.732391 2026] [:error] [pid 11280:tid 11293] [client 20.195.192.35:22870] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/nastar.php"] [unique_id "ahMlfIRn5s7laoSxy1QztAAAAEg"]
[Mon May 25 00:21:17.642856 2026] [:error] [pid 15835:tid 15838] [client 20.195.192.35:39414] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.well-known/nastar.php"] [unique_id "ahMlfWWbknYlUM9P0qMgPAAAAAE"]
[Mon May 25 00:21:18.425290 2026] [:error] [pid 11281:tid 11333] [client 20.195.192.35:2996] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "ahMlfpKmC9taWvA91j6nDQAAAJQ"]
[Mon May 25 00:21:19.641206 2026] [:error] [pid 11282:tid 11344] [client 20.195.192.35:33627] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "ahMlf-0bPyN3C7HZ1R_KVwAAAMQ"]
[Mon May 25 00:21:21.045387 2026] [:error] [pid 11281:tid 11334] [client 20.195.192.35:10585] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "ahMlgZKmC9taWvA91j6nEQAAAJU"]
[Mon May 25 00:21:21.837493 2026] [:error] [pid 11282:tid 11342] [client 20.195.192.35:18419] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/no1.php"] [unique_id "ahMlge0bPyN3C7HZ1R_KXAAAAMI"]
[Mon May 25 00:21:23.591170 2026] [:error] [pid 11368:tid 11381] [client 20.195.192.35:10547] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.sghb.php"] [unique_id "ahMlg4fq_sTmmtTKm1VjTAAAAQs"]
[Mon May 25 00:21:24.955168 2026] [:error] [pid 11282:tid 11355] [client 20.195.192.35:39376] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.sghb.php"] [unique_id "ahMlhO0bPyN3C7HZ1R_KZwAAAM8"]
[Mon May 25 00:21:26.235055 2026] [:error] [pid 15835:tid 15845] [client 20.195.192.35:22861] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.sghb.php"] [unique_id "ahMlhmWbknYlUM9P0qMgYgAAAAg"]
[Mon May 25 00:21:27.818822 2026] [:error] [pid 11280:tid 11306] [client 20.195.192.35:27147] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/.sghb.php"] [unique_id "ahMlh4Rn5s7laoSxy1QzvQAAAFU"]
[Mon May 25 00:21:29.300186 2026] [:error] [pid 11281:tid 11326] [client 20.195.192.35:24807] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jp.php"] [unique_id "ahMliZKmC9taWvA91j6nGAAAAI0"]
[Mon May 25 00:21:30.119168 2026] [:error] [pid 15835:tid 15857] [client 20.195.192.35:28756] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jp.php"] [unique_id "ahMlimWbknYlUM9P0qMgcAAAABQ"]
[Mon May 25 00:21:31.243326 2026] [:error] [pid 11282:tid 11349] [client 20.195.192.35:11099] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jp.php"] [unique_id "ahMli-0bPyN3C7HZ1R_KdQAAAMk"]
[Mon May 25 00:21:31.996750 2026] [:error] [pid 11282:tid 11358] [client 20.195.192.35:10564] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jp.php"] [unique_id "ahMli-0bPyN3C7HZ1R_KeAAAANI"]
[Mon May 25 00:21:32.844336 2026] [:error] [pid 11280:tid 11305] [client 20.195.192.35:27668] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "ahMljIRn5s7laoSxy1QzxQAAAFQ"]
[Mon May 25 00:21:33.652703 2026] [:error] [pid 11368:tid 11390] [client 20.195.192.35:13897] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "ahMljYfq_sTmmtTKm1VjZAAAARQ"]
[Mon May 25 00:21:34.462565 2026] [:error] [pid 11368:tid 11379] [client 20.195.192.35:13915] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "ahMljofq_sTmmtTKm1VjZwAAAQk"]
[Mon May 25 00:21:35.224570 2026] [:error] [pid 11282:tid 11345] [client 20.195.192.35:39394] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/f35.php"] [unique_id "ahMlj-0bPyN3C7HZ1R_KgAAAAMU"]
[Mon May 25 00:21:35.949073 2026] [:error] [pid 11281:tid 11332] [client 20.195.192.35:22863] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xa.php"] [unique_id "ahMlj5KmC9taWvA91j6nIwAAAJM"]
[Mon May 25 00:21:36.843187 2026] [:error] [pid 11281:tid 11324] [client 20.195.192.35:39410] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xa.php"] [unique_id "ahMlkJKmC9taWvA91j6nJQAAAIs"]
[Mon May 25 00:21:38.233211 2026] [:error] [pid 11280:tid 11286] [client 20.195.192.35:2972] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xa.php"] [unique_id "ahMlkoRn5s7laoSxy1QzywAAAEE"]
[Mon May 25 00:21:39.119919 2026] [:error] [pid 11280:tid 11299] [client 20.195.192.35:38337] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xa.php"] [unique_id "ahMlk4Rn5s7laoSxy1Qz0wAAAE4"]
[Mon May 25 00:21:40.258346 2026] [:error] [pid 15835:tid 15859] [client 20.195.192.35:10602] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-load.php"] [unique_id "ahMllGWbknYlUM9P0qMgfAAAABY"]
[Mon May 25 00:21:41.887091 2026] [:error] [pid 15835:tid 15860] [client 20.195.192.35:2953] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-load.php"] [unique_id "ahMllWWbknYlUM9P0qMgfwAAABc"]
[Mon May 25 00:21:42.745616 2026] [:error] [pid 11282:tid 11350] [client 20.195.192.35:28762] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-load.php"] [unique_id "ahMllu0bPyN3C7HZ1R_KhgAAAMo"]
[Mon May 25 00:21:43.807306 2026] [:error] [pid 11280:tid 11293] [client 20.195.192.35:24806] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-load.php"] [unique_id "ahMll4Rn5s7laoSxy1Qz1QAAAEg"]
[Mon May 25 00:21:45.865668 2026] [:error] [pid 11368:tid 11394] [client 20.195.192.35:2982] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xwpg.php"] [unique_id "ahMlmYfq_sTmmtTKm1VjdAAAARg"]
[Mon May 25 00:21:48.206850 2026] [:error] [pid 11282:tid 11343] [client 20.195.192.35:24827] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xwpg.php"] [unique_id "ahMlnO0bPyN3C7HZ1R_KjAAAAMM"]
[Mon May 25 00:21:49.290814 2026] [:error] [pid 15835:tid 15859] [client 20.195.192.35:39045] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xwpg.php"] [unique_id "ahMlnWWbknYlUM9P0qMgigAAABY"]
[Mon May 25 00:21:50.871682 2026] [:error] [pid 11282:tid 11341] [client 20.195.192.35:22391] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xwpg.php"] [unique_id "ahMlnu0bPyN3C7HZ1R_KjwAAAME"]
[Mon May 25 00:21:51.972935 2026] [:error] [pid 11280:tid 11307] [client 20.195.192.35:27673] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a5.php"] [unique_id "ahMln4Rn5s7laoSxy1Qz2gAAAFY"]
[Mon May 25 00:21:53.312421 2026] [:error] [pid 15835:tid 15857] [client 20.195.192.35:24815] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a5.php"] [unique_id "ahMloWWbknYlUM9P0qMgkAAAABQ"]
[Mon May 25 00:21:54.154396 2026] [:error] [pid 11280:tid 11298] [client 20.195.192.35:18327] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/a5.php"] [unique_id "ahMlooRn5s7laoSxy1Qz3gAAAE0"]
[Mon May 25 00:22:00.328385 2026] [:error] [pid 11281:tid 11321] [client 20.195.192.35:38362] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ddd.php"] [unique_id "ahMlqJKmC9taWvA91j6nRQAAAIg"]
[Mon May 25 00:22:01.264328 2026] [:error] [pid 11368:tid 11385] [client 20.195.192.35:12157] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ddd.php"] [unique_id "ahMlqYfq_sTmmtTKm1VjggAAAQ8"]
[Mon May 25 00:22:02.427868 2026] [:error] [pid 15835:tid 15857] [client 20.195.192.35:40206] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ddd.php"] [unique_id "ahMlqmWbknYlUM9P0qMguAAAABQ"]
[Mon May 25 00:22:05.073833 2026] [:error] [pid 11281:tid 11337] [client 20.195.192.35:40388] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ddd.php"] [unique_id "ahMlrZKmC9taWvA91j6nRgAAAJg"]
[Mon May 25 00:22:07.259847 2026] [:error] [pid 11368:tid 11387] [client 20.195.192.35:39103] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahMlr4fq_sTmmtTKm1VjhgAAARE"]
[Mon May 25 00:22:14.387842 2026] [:error] [pid 11368:tid 11381] [client 20.195.192.35:43632] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahMltofq_sTmmtTKm1VjkwAAAQs"]
[Mon May 25 00:22:16.139092 2026] [:error] [pid 11280:tid 11298] [client 20.195.192.35:17604] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahMluIRn5s7laoSxy1Qz5gAAAE0"]
[Mon May 25 00:22:17.668104 2026] [:error] [pid 15835:tid 15844] [client 20.195.192.35:19419] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/sunrise/"] [unique_id "ahMluWWbknYlUM9P0qMg1AAAAAc"]
[Mon May 25 00:22:19.064416 2026] [:error] [pid 15835:tid 15841] [client 20.195.192.35:17641] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jj.php"] [unique_id "ahMlu2WbknYlUM9P0qMg1wAAAAQ"]
[Mon May 25 00:22:22.542132 2026] [:error] [pid 15835:tid 15852] [client 20.195.192.35:17870] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jj.php"] [unique_id "ahMlvmWbknYlUM9P0qMg5AAAAA8"]
[Mon May 25 00:22:24.460039 2026] [:error] [pid 11368:tid 11374] [client 20.195.192.35:15764] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jj.php"] [unique_id "ahMlwIfq_sTmmtTKm1VjpgAAAQQ"]
[Mon May 25 00:22:25.786326 2026] [:error] [pid 11280:tid 11308] [client 20.195.192.35:19074] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/jj.php"] [unique_id "ahMlwYRn5s7laoSxy1Qz7gAAAFc"]
[Mon May 25 00:22:28.086374 2026] [:error] [pid 11368:tid 11390] [client 20.195.192.35:18079] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccc.php"] [unique_id "ahMlxIfq_sTmmtTKm1VjpwAAARQ"]
[Mon May 25 00:22:29.546386 2026] [:error] [pid 11281:tid 11321] [client 20.195.192.35:26666] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccc.php"] [unique_id "ahMlxZKmC9taWvA91j6nWgAAAIg"]
[Mon May 25 00:22:30.896613 2026] [:error] [pid 15835:tid 15860] [client 20.195.192.35:2133] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccc.php"] [unique_id "ahMlxmWbknYlUM9P0qMg6QAAABc"]
[Mon May 25 00:22:33.409337 2026] [:error] [pid 11282:tid 11354] [client 20.195.192.35:2154] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/ccc.php"] [unique_id "ahMlye0bPyN3C7HZ1R_KtAAAAM4"]
[Mon May 25 00:22:35.103923 2026] [:error] [pid 11368:tid 11370] [client 20.195.192.35:33024] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-link-snpm.php"] [unique_id "ahMly4fq_sTmmtTKm1VjqQAAAQA"]
[Mon May 25 00:22:36.319369 2026] [:error] [pid 11281:tid 11325] [client 20.195.192.35:13667] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-link-snpm.php"] [unique_id "ahMlzJKmC9taWvA91j6nYQAAAIw"]
[Mon May 25 00:22:39.887352 2026] [:error] [pid 11280:tid 11308] [client 20.195.192.35:2235] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-link-snpm.php"] [unique_id "ahMlz4Rn5s7laoSxy1Q0GAAAAFc"]
[Mon May 25 00:22:41.996772 2026] [:error] [pid 11368:tid 11394] [client 20.195.192.35:29250] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-link-snpm.php"] [unique_id "ahMl0Yfq_sTmmtTKm1VjvQAAARg"]
[Mon May 25 00:22:44.350373 2026] [:error] [pid 15835:tid 15841] [client 20.195.192.35:12033] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/4.php"] [unique_id "ahMl1GWbknYlUM9P0qMg_QAAAAQ"]
[Mon May 25 00:22:46.605088 2026] [:error] [pid 11368:tid 11394] [client 20.195.192.35:20352] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/4.php"] [unique_id "ahMl1ofq_sTmmtTKm1VjxAAAARg"]
[Mon May 25 00:22:47.793937 2026] [:error] [pid 11281:tid 11333] [client 20.195.192.35:11612] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/4.php"] [unique_id "ahMl15KmC9taWvA91j6nagAAAJQ"]
[Mon May 25 00:22:49.449567 2026] [:error] [pid 11281:tid 11321] [client 20.195.192.35:11643] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/4.php"] [unique_id "ahMl2ZKmC9taWvA91j6nbQAAAIg"]
[Mon May 25 00:22:52.780402 2026] [:error] [pid 11368:tid 11389] [client 20.195.192.35:29252] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xstelth.php"] [unique_id "ahMl3Ifq_sTmmtTKm1VjzwAAARM"]
[Mon May 25 00:22:54.431044 2026] [:error] [pid 11282:tid 11347] [client 20.195.192.35:12319] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xstelth.php"] [unique_id "ahMl3u0bPyN3C7HZ1R_K0gAAAMc"]
[Mon May 25 00:22:55.754890 2026] [:error] [pid 15835:tid 15838] [client 20.195.192.35:17840] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xstelth.php"] [unique_id "ahMl32WbknYlUM9P0qMhCwAAAAE"]
[Mon May 25 00:22:57.233385 2026] [:error] [pid 15835:tid 15845] [client 20.195.192.35:10791] [client 20.195.192.35] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/xstelth.php"] [unique_id "ahMl4WWbknYlUM9P0qMhEgAAAAg"]
[Mon May 25 03:06:51.785937 2026] [:error] [pid 11282:tid 11349] [client 52.242.222.214:32246] [client 52.242.222.214] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/(?:tinyfilemanager(?:\\\\.php)?|filemanager\\\\.php|fm\\\\.php|tiny\\\\.php|wp-content/plugins/pwnd/pwnd\\\\.php|wp-includes/(?:block-supports/autoload_classmap\\\\.php|Text/Diff/Engine/wp\\\\.php|blocks/details/about\\\\.php))$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "29"] [id "771002"] [msg "Blocked probe for known bad path/file manager/webshell"] [tag "probes"] [tag "wordpress"] [hostname "paramountestate.com.au"] [uri "/tiny.php"] [unique_id "ahNMS-0bPyN3C7HZ1R_y-wAAAMk"]
[Mon May 25 05:54:03.748470 2026] [:error] [pid 9303:tid 9357] [client 20.195.178.143:16514] [client 20.195.178.143] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.195.178.143, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ahNze33bQScbssitjPQy6QAAAFc"]
[Mon May 25 05:54:06.617432 2026] [:error] [pid 9303:tid 9335] [client 20.195.178.143:16514] [client 20.195.178.143] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.195.178.143, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ahNzfn3bQScbssitjPQy8gAAAEE"]
[Mon May 25 05:54:11.336742 2026] [:error] [pid 9303:tid 9334] [client 20.195.178.143:16514] [client 20.195.178.143] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ahNzg33bQScbssitjPQzAQAAAEA"]
[Mon May 25 07:09:22.097591 2026] [:error] [pid 9304:tid 9373] [client 104.28.214.122:38732] [client 104.28.214.122] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/ms-themes.php"] [unique_id "ahOFIuVEV2qpMC_1UzSV9wAAAIw"]
[Mon May 25 07:32:47.809101 2026] [:error] [pid 9303:tid 9351] [client 158.158.44.35:65234] [client 158.158.44.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/requests/src/response/about.php"] [unique_id "ahOKn33bQScbssitjPRLXAAAAFE"]
[Mon May 25 07:32:48.770110 2026] [:error] [pid 50423:tid 50436] [client 158.158.44.35:64650] [client 158.158.44.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.158.44.35, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ahOKoKJWO7En4nKEQ3hJZQAAAQs"]
[Mon May 25 07:32:49.256214 2026] [:error] [pid 50423:tid 50446] [client 158.158.44.35:64650] [client 158.158.44.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.158.44.35, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ahOKoaJWO7En4nKEQ3hJaQAAARU"]
[Mon May 25 07:32:53.416967 2026] [:error] [pid 50423:tid 50446] [client 158.158.44.35:64650] [client 158.158.44.35] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 158.158.44.35, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ahOKpaJWO7En4nKEQ3hJewAAARU"]
[Mon May 25 07:32:55.655191 2026] [:error] [pid 50423:tid 50445] [client 158.158.44.35:64650] [client 158.158.44.35] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 158.158.44.35, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ahOKp6JWO7En4nKEQ3hJhAAAARQ"]
[Mon May 25 07:32:58.605455 2026] [:error] [pid 50423:tid 50438] [client 158.158.44.35:64650] [client 158.158.44.35] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Response/about.php"] [unique_id "ahOKqqJWO7En4nKEQ3hJkAAAAQ0"]
[Mon May 25 13:14:52.036607 2026] [:error] [pid 62427:tid 62471] [client 178.128.87.202:53084] [client 178.128.87.202] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 178.128.87.202, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ahPazPMUa83fc4GDyBw1ngAAAU4"]
[Mon May 25 20:55:03.683693 2026] [:error] [pid 3698:tid 3700] [client 170.64.238.42:48342] [client 170.64.238.42] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "ahRGpwtZBEwA4fyFLKP0LgAAAQA"]
[Mon May 25 20:55:03.790908 2026] [:error] [pid 62426:tid 62449] [client 170.64.238.42:43894] [client 170.64.238.42] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.git/" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "www.paramountestate.com.au"] [uri "/.git/config"] [unique_id "ahRGp0j3D3Mo8ANpTRADEQAAABM"]
[Mon May 25 20:55:04.191051 2026] [:error] [pid 62428:tid 62506] [client 170.64.238.42:48376] [client 170.64.238.42] ModSecurity: Warning. Match of "pmFromFile userdata_wl_content_type" against "TX:0" required. [file "/usr/local/apache/modsecurity-cwaf/rules/10_HTTP_HTTP.conf"] [line "17"] [id "210710"] [rev "5"] [msg "COMODO WAF: Request content type is not allowed by policy. Please update file userdata_wl_content_type.||www.paramountestate.com.au|F|2"] [data "TX:0=text/plain"] [severity "CRITICAL"] [tag "CWAF"] [tag "HTTP"] [hostname "www.paramountestate.com.au"] [uri "/vendor/phpunit/phpunit/src/Util/PHP/eval-stdin.php"] [unique_id "ahRGqJNosGBa7mui3VRdqAAAAJY"]
[Tue May 26 10:30:56.772816 2026] [:error] [pid 55988:tid 55991] [client 212.32.76.2:48315] [client 212.32.76.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ahUF4P3kVIz2sql52sfHogAAAQA"]
[Tue May 26 10:31:02.136617 2026] [:error] [pid 55988:tid 56000] [client 203.25.124.213:20741] [client 203.25.124.213] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/edit-tags.php"] [unique_id "ahUF5v3kVIz2sql52sfHsAAAAQk"]
[Tue May 26 10:31:07.498751 2026] [:error] [pid 20024:tid 20051] [client 203.25.124.50:30143] [client 203.25.124.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wpx/"] [unique_id "ahUF61dk7QtxEB93Npc9_AAAAA0"]
[Tue May 26 10:31:27.868211 2026] [:error] [pid 20025:tid 20087] [client 203.25.124.71:59005] [client 203.25.124.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/"] [unique_id "ahUF_37k8Vts-JPOkgUTggAAAFY"]
[Tue May 26 10:31:48.288751 2026] [:error] [pid 20025:tid 20089] [client 203.25.124.51:29637] [client 203.25.124.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/speculative8.php"] [unique_id "ahUGFH7k8Vts-JPOkgUTsAAAAFg"]
[Tue May 26 10:32:58.694035 2026] [:error] [pid 20026:tid 20108] [client 203.25.124.50:43539] [client 203.25.124.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/admin.php"] [unique_id "ahUGWjXIXIr-5BZ8nR4nQwAAAJA"]
[Tue May 26 10:33:14.088627 2026] [:error] [pid 20024:tid 20047] [client 203.25.124.48:54193] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-config-sample.php"] [unique_id "ahUGaldk7QtxEB93Npc-dQAAAAk"]
[Tue May 26 10:33:14.463190 2026] [:error] [pid 20026:tid 20110] [client 203.25.124.41:55439] [client 203.25.124.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/"] [unique_id "ahUGajXIXIr-5BZ8nR4nWAAAAJI"]
[Tue May 26 10:33:19.823698 2026] [:error] [pid 55988:tid 55991] [client 203.25.124.211:24755] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyone/content-index.php"] [unique_id "ahUGb_3kVIz2sql52sfIrgAAAQA"]
[Tue May 26 10:33:45.195518 2026] [:error] [pid 20026:tid 20102] [client 203.25.124.54:30445] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wordpress/wp-admin/maint/"] [unique_id "ahUGiTXIXIr-5BZ8nR4nfwAAAIo"]
[Tue May 26 10:34:00.652286 2026] [:error] [pid 20125:tid 20127] [client 203.25.124.65:35871] [client 203.25.124.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/index/function.php"] [unique_id "ahUGmNk9jeWERFDLJc7RMQAAAMA"]
[Tue May 26 10:34:16.082452 2026] [:error] [pid 20024:tid 20052] [client 203.25.124.51:48715] [client 203.25.124.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/so-pinyin-slugs/inc/main_json.php"] [unique_id "ahUGqFdk7QtxEB93Npc-rAAAAA4"]
[Tue May 26 10:34:16.479905 2026] [:error] [pid 20025:tid 20089] [client 203.25.124.50:57457] [client 203.25.124.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin.php"] [unique_id "ahUGqH7k8Vts-JPOkgUVOQAAAFg"]
[Tue May 26 10:34:21.881016 2026] [:error] [pid 20125:tid 20139] [client 203.25.124.211:33347] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/x.php"] [unique_id "ahUGrdk9jeWERFDLJc7RYgAAAMw"]
[Tue May 26 10:34:22.252416 2026] [:error] [pid 20125:tid 20133] [client 203.25.124.48:51331] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/"] [unique_id "ahUGrtk9jeWERFDLJc7RZQAAAMY"]
[Tue May 26 10:34:47.722043 2026] [:error] [pid 20025:tid 20089] [client 203.25.124.54:28801] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/system.php"] [unique_id "ahUGx37k8Vts-JPOkgUV1wAAAFg"]
[Tue May 26 10:35:13.104590 2026] [:error] [pid 20125:tid 20145] [client 212.32.76.13:41081] [client 212.32.76.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/"] [unique_id "ahUG4dk9jeWERFDLJc7RiwAAANI"]
[Tue May 26 10:35:13.487076 2026] [:error] [pid 20125:tid 20135] [client 212.32.76.13:58043] [client 212.32.76.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/widgets/maint/"] [unique_id "ahUG4dk9jeWERFDLJc7RjQAAAMg"]
[Tue May 26 10:35:38.859288 2026] [:error] [pid 20025:tid 20089] [client 203.25.124.51:53575] [client 203.25.124.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/widgets/"] [unique_id "ahUG-n7k8Vts-JPOkgUWtgAAAFg"]
[Tue May 26 10:35:39.222462 2026] [:error] [pid 20125:tid 20128] [client 203.25.124.48:65381] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/enhanced-text-widget/analyst/src/403x.php"] [unique_id "ahUG-9k9jeWERFDLJc7RpAAAAME"]
[Tue May 26 10:35:39.586273 2026] [:error] [pid 20125:tid 20136] [client 203.25.124.50:64777] [client 203.25.124.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/includes/"] [unique_id "ahUG-9k9jeWERFDLJc7RpwAAAMk"]
[Tue May 26 10:35:39.950298 2026] [:error] [pid 55988:tid 55994] [client 203.25.124.73:34299] [client 203.25.124.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/ioxi-o.php"] [unique_id "ahUG-_3kVIz2sql52sfJ1wAAAQM"]
[Tue May 26 10:35:50.316492 2026] [:error] [pid 55988:tid 56013] [client 212.32.76.2:31815] [client 212.32.76.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/m.php"] [unique_id "ahUHBv3kVIz2sql52sfJ4AAAARY"]
[Tue May 26 10:36:00.692391 2026] [:error] [pid 20026:tid 20106] [client 203.25.124.48:36985] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/a.php"] [unique_id "ahUHEDXIXIr-5BZ8nR4ocAAAAI4"]
[Tue May 26 10:36:11.078353 2026] [:error] [pid 20025:tid 20077] [client 212.32.76.9:49705] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/shell/"] [unique_id "ahUHG37k8Vts-JPOkgUW8gAAAEw"]
[Tue May 26 10:36:36.561443 2026] [:error] [pid 20025:tid 20085] [client 203.25.124.73:38111] [client 203.25.124.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/edit.php"] [unique_id "ahUHNH7k8Vts-JPOkgUXGgAAAFQ"]
[Tue May 26 10:36:51.962766 2026] [:error] [pid 20025:tid 20084] [client 203.25.124.48:20659] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/packed.php"] [unique_id "ahUHQ37k8Vts-JPOkgUXUQAAAFM"]
[Tue May 26 10:36:57.323083 2026] [:error] [pid 20024:tid 20054] [client 203.25.124.54:40447] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/about.php"] [unique_id "ahUHSVdk7QtxEB93Npc_hAAAABA"]
[Tue May 26 10:37:02.691272 2026] [:error] [pid 20025:tid 20080] [client 212.32.76.9:33199] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/themes/"] [unique_id "ahUHTn7k8Vts-JPOkgUXewAAAE8"]
[Tue May 26 10:37:08.106022 2026] [:error] [pid 55988:tid 55992] [client 203.25.124.211:22243] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/"] [unique_id "ahUHVP3kVIz2sql52sfKLAAAAQE"]
[Tue May 26 10:37:23.608970 2026] [:error] [pid 55988:tid 55999] [client 203.25.124.71:27107] [client 203.25.124.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/"] [unique_id "ahUHY_3kVIz2sql52sfKPwAAAQg"]
[Tue May 26 10:37:23.966068 2026] [:error] [pid 55988:tid 56015] [client 212.32.76.2:64131] [client 212.32.76.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/config.php"] [unique_id "ahUHY_3kVIz2sql52sfKQgAAARg"]
[Tue May 26 10:37:29.347898 2026] [:error] [pid 55988:tid 56010] [client 212.32.76.7:45027] [client 212.32.76.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/wp-blog.php"] [unique_id "ahUHaf3kVIz2sql52sfKSAAAARM"]
[Tue May 26 10:37:44.713223 2026] [:error] [pid 20025:tid 20078] [client 203.25.124.54:24553] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/"] [unique_id "ahUHeH7k8Vts-JPOkgUXuwAAAE0"]
[Tue May 26 10:38:05.075956 2026] [:error] [pid 55988:tid 56004] [client 203.25.124.73:53033] [client 203.25.124.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/about.php"] [unique_id "ahUHjf3kVIz2sql52sfKbgAAAQ0"]
[Tue May 26 10:38:05.452821 2026] [:error] [pid 55988:tid 56000] [client 212.32.76.14:38561] [client 212.32.76.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/options.php"] [unique_id "ahUHjf3kVIz2sql52sfKbwAAAQk"]
[Tue May 26 10:38:10.813868 2026] [:error] [pid 20025:tid 20081] [client 203.25.124.72:60871] [client 203.25.124.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/coffee/"] [unique_id "ahUHkn7k8Vts-JPOkgUX9QAAAFA"]
[Tue May 26 10:38:11.187014 2026] [:error] [pid 20125:tid 20128] [client 203.25.124.72:44327] [client 203.25.124.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ahUHk9k9jeWERFDLJc7SRgAAAME"]
[Tue May 26 10:38:11.586525 2026] [:error] [pid 20025:tid 20084] [client 203.25.124.71:31873] [client 203.25.124.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-good.php"] [unique_id "ahUHk37k8Vts-JPOkgUX9gAAAFM"]
[Tue May 26 10:38:21.956197 2026] [:error] [pid 20024:tid 20060] [client 203.25.124.211:30261] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/class.php"] [unique_id "ahUHnVdk7QtxEB93Npc_rQAAABY"]
[Tue May 26 10:38:22.314926 2026] [:error] [pid 20024:tid 20062] [client 203.25.124.54:61967] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/hello-plus/classes/ehp-bes.php"] [unique_id "ahUHnldk7QtxEB93Npc_rgAAABg"]
[Tue May 26 10:38:22.683509 2026] [:error] [pid 55988:tid 56015] [client 212.32.76.2:20181] [client 212.32.76.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentythree/patterns/"] [unique_id "ahUHnv3kVIz2sql52sfKggAAARg"]
[Tue May 26 10:38:38.083955 2026] [:error] [pid 20025:tid 20073] [client 203.25.124.73:46289] [client 203.25.124.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/images/"] [unique_id "ahUHrn7k8Vts-JPOkgUYFgAAAEg"]
[Tue May 26 10:38:38.456244 2026] [:error] [pid 20025:tid 20089] [client 212.32.76.14:33271] [client 212.32.76.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Text/Diff/Renderer/"] [unique_id "ahUHrn7k8Vts-JPOkgUYGgAAAFg"]
[Tue May 26 10:38:38.829628 2026] [:error] [pid 20025:tid 20068] [client 203.25.124.213:61227] [client 203.25.124.213] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/network/cache/"] [unique_id "ahUHrn7k8Vts-JPOkgUYHQAAAEM"]
[Tue May 26 10:38:44.194025 2026] [:error] [pid 20025:tid 20079] [client 203.25.124.51:45371] [client 203.25.124.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/as.php"] [unique_id "ahUHtH7k8Vts-JPOkgUYNgAAAE4"]
[Tue May 26 10:39:24.581882 2026] [:error] [pid 20026:tid 20112] [client 212.32.76.7:55271] [client 212.32.76.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/autoload_classmap.php"] [unique_id "ahUH3DXIXIr-5BZ8nR4pDwAAAJQ"]
[Tue May 26 10:39:49.970678 2026] [:error] [pid 20025:tid 20080] [client 203.25.124.42:34693] [client 203.25.124.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/"] [unique_id "ahUH9X7k8Vts-JPOkgUZHwAAAE8"]
[Tue May 26 10:40:05.382670 2026] [:error] [pid 20125:tid 20130] [client 212.32.76.2:39851] [client 212.32.76.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/maint/chosen.php"] [unique_id "ahUIBdk9jeWERFDLJc7SuwAAAMM"]
[Tue May 26 10:40:10.778996 2026] [:error] [pid 55988:tid 56014] [client 203.25.124.54:40355] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/rest-api/fields/"] [unique_id "ahUICv3kVIz2sql52sfLKQAAARc"]
[Tue May 26 10:40:26.214923 2026] [:error] [pid 20025:tid 20082] [client 203.25.124.41:51275] [client 203.25.124.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/ocean/"] [unique_id "ahUIGn7k8Vts-JPOkgUZRgAAAFE"]
[Tue May 26 10:40:27.283782 2026] [:error] [pid 55988:tid 56001] [client 203.25.124.213:30691] [client 203.25.124.213] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/chosen.php"] [unique_id "ahUIG_3kVIz2sql52sfLSwAAAQo"]
[Tue May 26 10:40:27.805136 2026] [:error] [pid 20026:tid 20114] [client 203.25.124.73:49285] [client 203.25.124.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/widgets/"] [unique_id "ahUIGzXIXIr-5BZ8nR4pRQAAAJY"]
[Tue May 26 10:40:28.185315 2026] [:error] [pid 20024:tid 20055] [client 212.32.76.7:46679] [client 212.32.76.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/widgets/admin.php"] [unique_id "ahUIHFdk7QtxEB93Npc_-AAAABE"]
[Tue May 26 10:40:33.570880 2026] [:error] [pid 20125:tid 20148] [client 203.25.124.48:55613] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/"] [unique_id "ahUIIdk9jeWERFDLJc7SyAAAANU"]
[Tue May 26 10:41:34.022251 2026] [:error] [pid 20024:tid 20053] [client 212.32.76.13:45519] [client 212.32.76.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/preformatted/"] [unique_id "ahUIXldk7QtxEB93NpdACgAAAA8"]
[Tue May 26 10:41:44.996953 2026] [:error] [pid 55988:tid 56002] [client 203.25.124.213:64385] [client 203.25.124.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/jcrop/Jcrop.php"] [unique_id "ahUIaP3kVIz2sql52sfLpAAAAQs"]
[Tue May 26 10:42:15.388091 2026] [:error] [pid 55988:tid 56008] [client 203.25.124.41:59253] [client 203.25.124.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfour/patterns/template-singl-portfolio.php"] [unique_id "ahUIh_3kVIz2sql52sfLuwAAARE"]
[Tue May 26 10:42:15.987383 2026] [:error] [pid 55988:tid 55992] [client 203.25.124.213:28063] [client 203.25.124.213] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/news-portal/user-install.php"] [unique_id "ahUIh_3kVIz2sql52sfLvAAAAQE"]
[Tue May 26 10:42:16.351751 2026] [:error] [pid 20125:tid 20134] [client 212.32.76.13:51183] [client 212.32.76.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/system_core.php"] [unique_id "ahUIiNk9jeWERFDLJc7S_AAAAMc"]
[Tue May 26 10:42:26.791976 2026] [:error] [pid 20025:tid 20078] [client 203.25.124.41:64195] [client 203.25.124.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/"] [unique_id "ahUIkn7k8Vts-JPOkgUaKgAAAE0"]
[Tue May 26 10:42:47.170566 2026] [:error] [pid 55988:tid 56005] [client 203.25.124.42:47217] [client 203.25.124.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/database.php"] [unique_id "ahUIp_3kVIz2sql52sfL0QAAAQ4"]
[Tue May 26 10:42:47.531407 2026] [:error] [pid 20024:tid 20041] [client 203.25.124.73:53573] [client 203.25.124.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/css/colors/ectoplasm/"] [unique_id "ahUIp1dk7QtxEB93NpdALAAAAAM"]
[Tue May 26 10:42:52.985932 2026] [:error] [pid 20025:tid 20074] [client 203.25.124.211:34653] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/gallery/"] [unique_id "ahUIrH7k8Vts-JPOkgUabQAAAEk"]
[Tue May 26 10:42:53.688376 2026] [:error] [pid 20026:tid 20102] [client 203.25.124.41:25913] [client 203.25.124.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/languages/autoload_classmap.php"] [unique_id "ahUIrTXIXIr-5BZ8nR4pngAAAIo"]
[Tue May 26 10:42:59.054003 2026] [:error] [pid 20125:tid 20136] [client 203.25.124.42:58511] [client 203.25.124.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/group/"] [unique_id "ahUIs9k9jeWERFDLJc7THwAAAMk"]
[Tue May 26 10:43:04.455034 2026] [:error] [pid 20024:tid 20062] [client 203.25.124.213:44291] [client 203.25.124.213] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/media-text/"] [unique_id "ahUIuFdk7QtxEB93NpdASgAAABg"]
[Tue May 26 10:43:24.858784 2026] [:error] [pid 55988:tid 55995] [client 212.32.76.9:25103] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wmore1.php"] [unique_id "ahUIzP3kVIz2sql52sfMIwAAAQQ"]
[Tue May 26 10:43:30.282829 2026] [:error] [pid 20024:tid 20040] [client 203.25.124.48:23387] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/src/Content/Type/"] [unique_id "ahUI0ldk7QtxEB93NpdAXQAAAAI"]
[Tue May 26 10:43:30.673283 2026] [:error] [pid 20024:tid 20059] [client 203.25.124.54:57415] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfour/assets/"] [unique_id "ahUI0ldk7QtxEB93NpdAXgAAABU"]
[Tue May 26 10:43:36.207480 2026] [:error] [pid 20125:tid 20127] [client 203.25.124.73:53575] [client 203.25.124.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/src/Core/"] [unique_id "ahUI2Nk9jeWERFDLJc7TQgAAAMA"]
[Tue May 26 10:43:46.709619 2026] [:error] [pid 20025:tid 20077] [client 212.32.76.14:40831] [client 212.32.76.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/themes/"] [unique_id "ahUI4n7k8Vts-JPOkgUapAAAAEw"]
[Tue May 26 10:43:47.087602 2026] [:error] [pid 20025:tid 20088] [client 203.25.124.41:29185] [client 203.25.124.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/PHPMailer/widgets/"] [unique_id "ahUI437k8Vts-JPOkgUapgAAAFc"]
[Tue May 26 10:43:47.487773 2026] [:error] [pid 20025:tid 20076] [client 203.25.124.72:44597] [client 203.25.124.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/radio.php"] [unique_id "ahUI437k8Vts-JPOkgUaqQAAAEs"]
[Tue May 26 10:43:47.882970 2026] [:error] [pid 20125:tid 20133] [client 203.25.124.72:59217] [client 203.25.124.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wp-config-backup.php"] [unique_id "ahUI49k9jeWERFDLJc7TUAAAAMY"]
[Tue May 26 10:44:08.415714 2026] [:error] [pid 20025:tid 20087] [client 212.32.76.7:40527] [client 212.32.76.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/install.php"] [unique_id "ahUI-H7k8Vts-JPOkgUaygAAAFY"]
[Tue May 26 10:44:13.796986 2026] [:error] [pid 20026:tid 20115] [client 212.32.76.9:45717] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/script-loader-react-refresh.php"] [unique_id "ahUI_TXIXIr-5BZ8nR4qAwAAAJc"]
[Tue May 26 10:44:14.188891 2026] [:error] [pid 20026:tid 20106] [client 203.25.124.211:28309] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sitemaps/"] [unique_id "ahUI_jXIXIr-5BZ8nR4qBQAAAI4"]
[Tue May 26 10:44:19.555983 2026] [:error] [pid 20026:tid 20108] [client 203.25.124.73:48995] [client 203.25.124.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/elementor/css/"] [unique_id "ahUJAzXIXIr-5BZ8nR4qDQAAAJA"]
[Tue May 26 10:44:40.053230 2026] [:error] [pid 20025:tid 20082] [client 203.25.124.211:62413] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/pomo/"] [unique_id "ahUJGH7k8Vts-JPOkgUa-AAAAFE"]
[Tue May 26 10:44:40.488812 2026] [:error] [pid 55988:tid 56004] [client 203.25.124.48:50709] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/php-compat/"] [unique_id "ahUJGP3kVIz2sql52sfMiAAAAQ0"]
[Tue May 26 10:44:40.857668 2026] [:error] [pid 55988:tid 55999] [client 203.25.124.72:31315] [client 203.25.124.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/222.php"] [unique_id "ahUJGP3kVIz2sql52sfMigAAAQg"]
[Tue May 26 10:44:46.294691 2026] [:error] [pid 20125:tid 20151] [client 212.32.76.9:26119] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/panel.php"] [unique_id "ahUJHtk9jeWERFDLJc7TmgAAANg"]
[Tue May 26 10:44:56.678317 2026] [:error] [pid 20125:tid 20150] [client 212.32.76.9:49253] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/customize/wp-conflg.php"] [unique_id "ahUJKNk9jeWERFDLJc7ToAAAANc"]
[Tue May 26 10:45:37.085105 2026] [:error] [pid 20025:tid 20083] [client 212.32.76.9:46965] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/backup.php"] [unique_id "ahUJUX7k8Vts-JPOkgUbXgAAAFI"]
[Tue May 26 10:45:37.449157 2026] [:error] [pid 20025:tid 20081] [client 203.25.124.48:50717] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/login.php"] [unique_id "ahUJUX7k8Vts-JPOkgUbYQAAAFA"]
[Tue May 26 10:45:47.808790 2026] [:error] [pid 20024:tid 20059] [client 203.25.124.213:25081] [client 203.25.124.213] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/maintenance.php"] [unique_id "ahUJW1dk7QtxEB93NpdAvQAAABU"]
[Tue May 26 10:45:58.183319 2026] [:error] [pid 20025:tid 20068] [client 203.25.124.48:27017] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/nic.php"] [unique_id "ahUJZn7k8Vts-JPOkgUbfwAAAEM"]
[Tue May 26 10:46:23.570334 2026] [:error] [pid 20025:tid 20066] [client 212.32.76.7:34219] [client 212.32.76.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/elementor/google-fonts/fonts/"] [unique_id "ahUJf37k8Vts-JPOkgUb4AAAAEE"]
[Tue May 26 10:46:28.984272 2026] [:error] [pid 20024:tid 20061] [client 203.25.124.213:64219] [client 203.25.124.213] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/heading/"] [unique_id "ahUJhFdk7QtxEB93NpdA7gAAABc"]
[Tue May 26 10:46:34.402158 2026] [:error] [pid 20025:tid 20071] [client 212.32.76.9:35717] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/wf-logs.php"] [unique_id "ahUJin7k8Vts-JPOkgUcBQAAAEY"]
[Tue May 26 10:46:49.790869 2026] [:error] [pid 20125:tid 20146] [client 212.32.76.9:32711] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/cgi-bin/cgi-bin/panel.php"] [unique_id "ahUJmdk9jeWERFDLJc7UBgAAANM"]
[Tue May 26 10:47:05.161745 2026] [:error] [pid 55988:tid 55992] [client 212.32.76.2:61281] [client 212.32.76.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/img/about.php"] [unique_id "ahUJqf3kVIz2sql52sfNawAAAQE"]
[Tue May 26 10:48:20.583045 2026] [:error] [pid 55988:tid 56006] [client 203.25.124.48:53051] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/src/Core/about.php"] [unique_id "ahUJ9P3kVIz2sql52sfORAAAAQ8"]
[Tue May 26 10:48:20.985833 2026] [:error] [pid 20125:tid 20141] [client 203.25.124.50:44271] [client 203.25.124.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/pullquote/wp-login.php"] [unique_id "ahUJ9Nk9jeWERFDLJc7UcQAAAM4"]
[Tue May 26 10:48:41.373626 2026] [:error] [pid 20026:tid 20107] [client 212.32.76.9:63331] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/SimplePie/library/SimplePie/Parse/wp-login.php"] [unique_id "ahUKCTXIXIr-5BZ8nR4q3gAAAI8"]
[Tue May 26 10:48:46.755780 2026] [:error] [pid 20025:tid 20085] [client 212.32.76.9:49161] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/preformatted/about.php"] [unique_id "ahUKDn7k8Vts-JPOkgUc3gAAAFQ"]
[Tue May 26 10:48:48.688529 2026] [:error] [pid 20025:tid 20066] [client 212.32.76.2:61345] [client 212.32.76.2] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/about.php"] [unique_id "ahUKEH7k8Vts-JPOkgUc4gAAAEE"]
[Tue May 26 10:48:54.081807 2026] [:error] [pid 20125:tid 20148] [client 203.25.124.41:38617] [client 203.25.124.41] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/code/about.php"] [unique_id "ahUKFtk9jeWERFDLJc7UoQAAANU"]
[Tue May 26 10:48:54.460460 2026] [:error] [pid 20026:tid 20115] [client 212.32.76.14:39205] [client 212.32.76.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/social-links/wp-login.php"] [unique_id "ahUKFjXIXIr-5BZ8nR4q6QAAAJc"]
[Tue May 26 10:49:09.886856 2026] [:error] [pid 20125:tid 20129] [client 203.25.124.54:36567] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/social-links/"] [unique_id "ahUKJdk9jeWERFDLJc7UswAAAMI"]
[Tue May 26 10:49:20.691094 2026] [:error] [pid 20125:tid 20130] [client 203.25.124.71:64995] [client 203.25.124.71] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/social-links/about.php"] [unique_id "ahUKMNk9jeWERFDLJc7UtgAAAMM"]
[Tue May 26 10:49:41.183598 2026] [:error] [pid 20026:tid 20106] [client 212.32.76.13:43839] [client 212.32.76.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/veq/aaa.php"] [unique_id "ahUKRTXIXIr-5BZ8nR4rCQAAAI4"]
[Tue May 26 10:49:41.549550 2026] [:error] [pid 20125:tid 20148] [client 203.25.124.42:45721] [client 203.25.124.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/post-featured-image/"] [unique_id "ahUKRdk9jeWERFDLJc7U7gAAANU"]
[Tue May 26 10:49:56.922898 2026] [:error] [pid 55988:tid 56005] [client 203.25.124.51:23721] [client 203.25.124.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/term-description/"] [unique_id "ahUKVP3kVIz2sql52sfOngAAAQ4"]
[Tue May 26 10:50:12.289211 2026] [:error] [pid 20125:tid 20143] [client 203.25.124.72:59985] [client 203.25.124.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/crop/index.php"] [unique_id "ahUKZNk9jeWERFDLJc7VAAAAANA"]
[Tue May 26 10:50:12.684484 2026] [:error] [pid 20125:tid 20138] [client 203.25.124.211:40435] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/skins/lightgray/"] [unique_id "ahUKZNk9jeWERFDLJc7VAQAAAMs"]
[Tue May 26 10:50:28.055476 2026] [:error] [pid 20125:tid 20132] [client 203.25.124.73:47255] [client 203.25.124.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/includes/admin.php"] [unique_id "ahUKdNk9jeWERFDLJc7VGAAAAMU"]
[Tue May 26 10:50:38.421188 2026] [:error] [pid 20125:tid 20136] [client 212.32.76.7:53331] [client 212.32.76.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/zsdhb.php"] [unique_id "ahUKftk9jeWERFDLJc7VJgAAAMk"]
[Tue May 26 10:50:38.905820 2026] [:error] [pid 20026:tid 20109] [client 203.25.124.71:58817] [client 203.25.124.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/revision-long.php"] [unique_id "ahUKfjXIXIr-5BZ8nR4rOwAAAJE"]
[Tue May 26 10:50:54.282067 2026] [:error] [pid 20025:tid 20089] [client 212.32.76.7:29089] [client 212.32.76.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/includes/revision-path.php"] [unique_id "ahUKjn7k8Vts-JPOkgUdYQAAAFg"]
[Tue May 26 10:50:59.653560 2026] [:error] [pid 20025:tid 20073] [client 212.32.76.9:42361] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/details/xmu.php"] [unique_id "ahUKk37k8Vts-JPOkgUddwAAAEg"]
[Tue May 26 10:51:15.016029 2026] [:error] [pid 20024:tid 20051] [client 203.25.124.54:24979] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/images/chosen.php"] [unique_id "ahUKo1dk7QtxEB93NpdBjgAAAA0"]
[Tue May 26 10:51:25.383147 2026] [:error] [pid 20025:tid 20082] [client 203.25.124.211:63263] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/network/cache/classwithtostring.php"] [unique_id "ahUKrX7k8Vts-JPOkgUduQAAAFE"]
[Tue May 26 10:51:30.743082 2026] [:error] [pid 55988:tid 56002] [client 203.25.124.211:42771] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/elex/elex.php"] [unique_id "ahUKsv3kVIz2sql52sfO6gAAAQs"]
[Tue May 26 10:51:46.282460 2026] [:error] [pid 20125:tid 20133] [client 203.25.124.42:64409] [client 203.25.124.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/Divi/includes/builder/"] [unique_id "ahUKwtk9jeWERFDLJc7VSwAAAMY"]
[Tue May 26 10:52:01.668096 2026] [:error] [pid 20025:tid 20066] [client 212.32.76.13:51123] [client 212.32.76.13] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "ahUK0X7k8Vts-JPOkgUd9gAAAEE"]
[Tue May 26 10:52:02.031896 2026] [:error] [pid 20025:tid 20068] [client 203.25.124.54:39209] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/dev.ndmd.kn/wp-includes/js/tinymce/wp-tinymce.php"] [unique_id "ahUK0n7k8Vts-JPOkgUd9wAAAEM"]
[Tue May 26 10:52:17.392846 2026] [:error] [pid 20025:tid 20072] [client 203.25.124.54:60039] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/login.php"] [unique_id "ahUK4X7k8Vts-JPOkgUeDQAAAEc"]
[Tue May 26 10:52:17.759708 2026] [:error] [pid 20125:tid 20151] [client 203.25.124.54:59759] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/duplicator-pro/ctrls/class.web.services.php"] [unique_id "ahUK4dk9jeWERFDLJc7VZgAAANg"]
[Tue May 26 10:52:18.123592 2026] [:error] [pid 20025:tid 20073] [client 203.25.124.41:44711] [client 203.25.124.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/min.php"] [unique_id "ahUK4n7k8Vts-JPOkgUeEgAAAEg"]
[Tue May 26 10:52:28.589960 2026] [:error] [pid 20026:tid 20101] [client 203.25.124.41:40687] [client 203.25.124.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/enhanced-text-widget1/analyst/src/403x.php"] [unique_id "ahUK7DXIXIr-5BZ8nR4rjAAAAIk"]
[Tue May 26 10:52:28.950854 2026] [:error] [pid 20125:tid 20137] [client 203.25.124.72:28803] [client 203.25.124.72] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/backup.php"] [unique_id "ahUK7Nk9jeWERFDLJc7VbAAAAMo"]
[Tue May 26 10:52:34.317398 2026] [:error] [pid 55988:tid 55999] [client 203.25.124.50:34709] [client 203.25.124.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wolf.php"] [unique_id "ahUK8v3kVIz2sql52sfPJgAAAQg"]
[Tue May 26 10:52:44.692754 2026] [:error] [pid 20026:tid 20115] [client 203.25.124.213:51483] [client 203.25.124.213] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/akismet/_inc/img/PRffc.php"] [unique_id "ahUK_DXIXIr-5BZ8nR4rlAAAAJc"]
[Tue May 26 10:53:15.081688 2026] [:error] [pid 20025:tid 20076] [client 203.25.124.51:33631] [client 203.25.124.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-patterns/chosen.php"] [unique_id "ahULG37k8Vts-JPOkgUepgAAAEs"]
[Tue May 26 10:53:30.464669 2026] [:error] [pid 20025:tid 20068] [client 203.25.124.48:57693] [client 203.25.124.48] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/chillbud/inc/content/templates/"] [unique_id "ahULKn7k8Vts-JPOkgUezgAAAEM"]
[Tue May 26 10:53:30.844167 2026] [:error] [pid 20025:tid 20074] [client 212.32.76.14:57061] [client 212.32.76.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/revslider/admin/assets/js/plugins/admin.php"] [unique_id "ahULKn7k8Vts-JPOkgUe0AAAAEk"]
[Tue May 26 10:53:31.205921 2026] [:error] [pid 20024:tid 20054] [client 212.32.76.14:39111] [client 212.32.76.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/uploads/wp-load.php"] [unique_id "ahULK1dk7QtxEB93NpdB3gAAABA"]
[Tue May 26 10:53:36.584325 2026] [:error] [pid 20025:tid 20080] [client 203.25.124.65:49819] [client 203.25.124.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/js_composer/assets/lib/bower/nivoslider/themes/module.php"] [unique_id "ahULMH7k8Vts-JPOkgUe2QAAAE8"]
[Tue May 26 10:53:36.952252 2026] [:error] [pid 20026:tid 20115] [client 212.32.76.9:20649] [client 212.32.76.9] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/sodium_compat/wp-conflg.php"] [unique_id "ahULMDXIXIr-5BZ8nR4rtwAAAJc"]
[Tue May 26 10:53:57.598064 2026] [:error] [pid 20024:tid 20041] [client 203.25.124.41:52029] [client 203.25.124.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/js_composer/assets/js/frontend_editor/vendors/plugins/xmlrpc.php"] [unique_id "ahULRVdk7QtxEB93NpdCAgAAAAM"]
[Tue May 26 10:54:07.985840 2026] [:error] [pid 20125:tid 20142] [client 212.32.76.2:23737] [client 212.32.76.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/js_composer/assets/lib/vc_chart/about.php"] [unique_id "ahULT9k9jeWERFDLJc7VzQAAAM8"]
[Tue May 26 10:54:08.385777 2026] [:error] [pid 20125:tid 20150] [client 203.25.124.73:42705] [client 203.25.124.73] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/the-events-calendar/common/vendor/vendor-prefixed/monolog/monolog/about.php"] [unique_id "ahULUNk9jeWERFDLJc7VzgAAANc"]
[Tue May 26 10:54:23.768494 2026] [:error] [pid 20125:tid 20131] [client 203.25.124.54:32767] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/css/dist/block-directory/"] [unique_id "ahULX9k9jeWERFDLJc7V2QAAAMQ"]
[Tue May 26 10:54:25.772005 2026] [:error] [pid 20125:tid 20137] [client 203.25.124.50:22035] [client 203.25.124.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentynineteen/sass/forms/"] [unique_id "ahULYdk9jeWERFDLJc7V3wAAAMo"]
[Tue May 26 10:54:36.188933 2026] [:error] [pid 55988:tid 56005] [client 203.25.124.42:64031] [client 203.25.124.42] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/true.php"] [unique_id "ahULbP3kVIz2sql52sfP9gAAAQ4"]
[Tue May 26 10:54:36.581003 2026] [:error] [pid 20125:tid 20147] [client 212.32.76.13:52551] [client 212.32.76.13] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-includes/Requests/src/Proxy/"] [unique_id "ahULbNk9jeWERFDLJc7V5AAAANQ"]
[Tue May 26 10:54:36.986869 2026] [:error] [pid 20125:tid 20133] [client 203.25.124.51:32497] [client 203.25.124.51] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/assets/wp-canser.php"] [unique_id "ahULbNk9jeWERFDLJc7V5QAAAMY"]
[Tue May 26 10:55:02.390762 2026] [:error] [pid 20025:tid 20065] [client 203.25.124.65:57023] [client 203.25.124.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/options-discussion-statement.php"] [unique_id "ahULhn7k8Vts-JPOkgUfrwAAAEA"]
[Tue May 26 10:55:22.808144 2026] [:error] [pid 20025:tid 20081] [client 203.25.124.65:56697] [client 203.25.124.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/wp/content/aswfy/admin.php"] [unique_id "ahULmn7k8Vts-JPOkgUf2QAAAFA"]
[Tue May 26 10:55:28.308042 2026] [:error] [pid 20125:tid 20139] [client 203.25.124.65:30719] [client 203.25.124.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/htt.php"] [unique_id "ahULoNk9jeWERFDLJc7WBwAAAMw"]
[Tue May 26 10:55:43.681376 2026] [:error] [pid 20024:tid 20038] [client 203.25.124.213:55281] [client 203.25.124.213] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/default/"] [unique_id "ahULr1dk7QtxEB93NpdCOgAAAAA"]
[Tue May 26 10:56:19.178997 2026] [:error] [pid 20125:tid 20150] [client 203.25.124.73:54881] [client 203.25.124.73] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/chosen.php"] [unique_id "ahUL09k9jeWERFDLJc7WKgAAANc"]
[Tue May 26 10:56:34.550440 2026] [:error] [pid 20024:tid 20053] [client 203.25.124.54:26653] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/images/about.php"] [unique_id "ahUL4ldk7QtxEB93NpdCXwAAAA8"]
[Tue May 26 10:56:39.977085 2026] [:error] [pid 20024:tid 20043] [client 212.32.76.14:48649] [client 212.32.76.14] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentyfive/parts/"] [unique_id "ahUL51dk7QtxEB93NpdCZQAAAAU"]
[Tue May 26 10:57:05.579177 2026] [:error] [pid 55988:tid 55997] [client 203.25.124.50:57477] [client 203.25.124.50] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/js/widgets/images/"] [unique_id "ahUMAf3kVIz2sql52sfQwgAAAQY"]
[Tue May 26 10:57:26.286291 2026] [:error] [pid 20026:tid 20095] [client 203.25.124.72:47559] [client 203.25.124.72] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/user_data/SafetyTips/"] [unique_id "ahUMFjXIXIr-5BZ8nR4sRwAAAIM"]
[Tue May 26 10:57:31.649844 2026] [:error] [pid 20025:tid 20081] [client 203.25.124.50:54995] [client 203.25.124.50] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/images/media/zo.php"] [unique_id "ahUMG37k8Vts-JPOkgUghwAAAFA"]
[Tue May 26 10:57:32.006342 2026] [:error] [pid 20024:tid 20055] [client 203.25.124.213:56909] [client 203.25.124.213] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/xltt.php"] [unique_id "ahUMHFdk7QtxEB93NpdCfwAAABE"]
[Tue May 26 10:57:57.437462 2026] [:error] [pid 55988:tid 56005] [client 212.32.76.7:25639] [client 212.32.76.7] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/cgi-bin/cgi-bin/upload.php"] [unique_id "ahUMNf3kVIz2sql52sfRCwAAAQ4"]
[Tue May 26 10:58:18.103700 2026] [:error] [pid 55988:tid 55993] [client 203.25.124.54:28021] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/rithin.php"] [unique_id "ahUMSv3kVIz2sql52sfRNQAAAQI"]
[Tue May 26 10:58:38.487497 2026] [:error] [pid 20024:tid 20052] [client 212.32.76.14:20213] [client 212.32.76.14] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/block-supports/wp-conflg.php"] [unique_id "ahUMXldk7QtxEB93NpdCnwAAAA4"]
[Tue May 26 10:58:48.850903 2026] [:error] [pid 20025:tid 20087] [client 203.25.124.65:57895] [client 203.25.124.65] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/network/theme-install-variable.php"] [unique_id "ahUMaH7k8Vts-JPOkgUhCAAAAFY"]
[Tue May 26 10:59:14.216449 2026] [:error] [pid 20026:tid 20094] [client 203.25.124.51:34971] [client 203.25.124.51] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentytwentytwo/admin.php"] [unique_id "ahUMgjXIXIr-5BZ8nR4sqAAAAII"]
[Tue May 26 10:59:19.576186 2026] [:error] [pid 20026:tid 20100] [client 203.25.124.71:62275] [client 203.25.124.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins-off/core.php"] [unique_id "ahUMhzXIXIr-5BZ8nR4sqgAAAIg"]
[Tue May 26 10:59:24.944478 2026] [:error] [pid 20026:tid 20114] [client 203.25.124.41:29677] [client 203.25.124.41] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/theme/config.php"] [unique_id "ahUMjDXIXIr-5BZ8nR4sqwAAAJY"]
[Tue May 26 10:59:30.308377 2026] [:error] [pid 20024:tid 20057] [client 203.25.124.71:50445] [client 203.25.124.71] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/maxcoach/"] [unique_id "ahUMkldk7QtxEB93NpdC1AAAABM"]
[Tue May 26 10:59:40.680266 2026] [:error] [pid 20024:tid 20062] [client 212.32.76.2:28649] [client 212.32.76.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/plugins/kqsksia/classwithtostring.php"] [unique_id "ahUMnFdk7QtxEB93NpdC3gAAABg"]
[Tue May 26 10:59:46.049731 2026] [:error] [pid 20025:tid 20069] [client 203.25.124.54:55765] [client 203.25.124.54] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/blocks/pullquote/1.php"] [unique_id "ahUMon7k8Vts-JPOkgUhvwAAAEQ"]
[Tue May 26 10:59:56.449438 2026] [:error] [pid 20125:tid 20133] [client 203.25.124.211:27075] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/wp-wlx.php"] [unique_id "ahUMrNk9jeWERFDLJc7W-QAAAMY"]
[Tue May 26 10:59:56.806618 2026] [:error] [pid 20025:tid 20074] [client 203.25.124.211:40107] [client 203.25.124.211] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-admin/media-upload-double.php"] [unique_id "ahUMrH7k8Vts-JPOkgUh5QAAAEk"]
[Tue May 26 11:00:02.178361 2026] [:error] [pid 20024:tid 20044] [client 212.32.76.2:60175] [client 212.32.76.2] ModSecurity: Access denied with code 403 (phase 1). String match "Go-http-client" at REQUEST_HEADERS:User-Agent. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "36"] [id "771003"] [msg "Blocked bad bot user-agent: Go-http-client"] [tag "bad_bot"] [hostname "paramountestate.com.au"] [uri "/wp-content/themes/twentynineteen/content-"] [unique_id "ahUMsldk7QtxEB93NpdDBwAAAAY"]
[Tue May 26 12:15:20.497701 2026] [:error] [pid 55988:tid 56013] [client 20.104.227.76:8310] [client 20.104.227.76] ModSecurity: Warning. Pattern match "/wp-login\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "14"] [id "400003"] [msg "wp-login.php hit from 20.104.227.76, incrementing brute counter"] [hostname "paramountestate.com.au"] [uri "/wp-login.php"] [unique_id "ahUeWP3kVIz2sql52sfyCgAAARY"]
[Tue May 26 12:15:23.357620 2026] [:error] [pid 55988:tid 56007] [client 20.104.227.76:8310] [client 20.104.227.76] ModSecurity: Warning. Pattern match "/xmlrpc\\\\.php" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_Wordpress.conf"] [line "6"] [id "400001"] [msg "xmlrpc.php hit from 20.104.227.76, incrementing ddos counter"] [hostname "paramountestate.com.au"] [uri "/xmlrpc.php"] [unique_id "ahUeW_3kVIz2sql52sfyFAAAARA"]
[Tue May 26 12:15:31.002842 2026] [:error] [pid 55988:tid 55991] [client 20.104.227.76:8310] [client 20.104.227.76] ModSecurity: Access denied with code 403 (phase 1). Pattern match "^/wp-includes/.*\\\\.php$" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "15"] [id "771001"] [msg "Blocked direct PHP under wp-includes"] [tag "wordpress"] [tag "hardening"] [hostname "paramountestate.com.au"] [uri "/wp-includes/IXR/test1.php"] [unique_id "ahUeY_3kVIz2sql52sfyOwAAAQA"]
[Tue May 26 17:05:07.922648 2026] [:error] [pid 20025:tid 20076] [client 34.11.17.55:56563] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/"] [unique_id "ahViQ37k8Vts-JPOkgXPhQAAAEs"]
[Tue May 26 17:05:08.359773 2026] [:error] [pid 55988:tid 55999] [client 34.11.17.55:59989] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/wp-includes/ID3/license.txt"] [unique_id "ahViRP3kVIz2sql52sdhowAAAQg"]
[Tue May 26 17:05:08.821506 2026] [:error] [pid 55988:tid 56009] [client 34.11.17.55:58506] [client 34.11.17.55] ModSecurity: Access denied with connection close (phase 1). Operator GT matched 10 at IP:wp404_cnt. [file "/usr/local/apache/modsecurity-cwaf/rules/99_Custom_WebShells.conf"] [line "47"] [id "771005"] [msg "Too many 404s in short window (likely scanner)"] [tag "rate_limit"] [tag "probes"] [hostname "paramountestate.com.au"] [uri "/feed/"] [unique_id "ahViRP3kVIz2sql52sdhxgAAARI"]
[Tue May 26 17:54:06.686636 2026] [:error] [pid 43701:tid 43703] [client 176.65.139.238:50846] [client 176.65.139.238] ModSecurity: Access denied with code 403 (phase 1). Matched phrase "/.env" at REQUEST_URI. [file "/usr/local/apache/modsecurity-cwaf/rules/02_Global_Generic.conf"] [line "117"] [id "210492"] [rev "3"] [severity "CRITICAL"] [tag "CWAF"] [tag "Generic"] [hostname "paramountestate.com.au"] [uri "/.env"] [unique_id "ahVtvoWtVI_UGrhtwKASkAAAAUA"]